From e06ac2d6a2ac35ed4397936fb0d9a9da417b7d6b Mon Sep 17 00:00:00 2001 From: Kyosuke Fujimoto Date: Sun, 1 Nov 2026 09:32:22 +0900 Subject: [PATCH 1/2] Adopt GitHub Actions dependency lockfile --- .github/workflows/actions.lock | 108 ++++++++++++++++++++++++++ .github/workflows/build.yml | 12 +-- .github/workflows/deny.yml | 4 +- .github/workflows/gh-pages.yml | 8 +- .github/workflows/pinact.yml | 29 ------- .github/workflows/release.yml | 10 +-- .github/workflows/verify-lockfile.yml | 32 ++++++++ 7 files changed, 157 insertions(+), 46 deletions(-) create mode 100644 .github/workflows/actions.lock delete mode 100644 .github/workflows/pinact.yml create mode 100644 .github/workflows/verify-lockfile.yml diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock new file mode 100644 index 00000000..0edb9f8f --- /dev/null +++ b/.github/workflows/actions.lock @@ -0,0 +1,108 @@ +# This file is machine-generated by `gh actions-lock`. +# Do not edit by hand; run `gh actions-lock` to update. +# Docs: https://gh.io/actions-lockfile +version: 'v0.0.3' +workflows: + '.github/workflows/build.yml': + - 'actions/checkout@v7.0.1' + - 'dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de' + - 'houseabsolute/actions-rust-cross@v1.0.8' + - 'swatinem/rust-cache@v2.9.2' + '.github/workflows/deny.yml': + - 'actions/checkout@v7.0.1' + - 'embarkstudios/cargo-deny-action@v2.1.1' + '.github/workflows/gh-pages.yml': + - 'actions/checkout@v7.0.1' + - 'actions/configure-pages@v6.0.0' + - 'actions/deploy-pages@v5.0.1' + - 'actions/upload-pages-artifact@v5.0.0' + '.github/workflows/release.yml': + - 'actions/checkout@v7.0.1' + - 'actions/download-artifact@v8.0.1' + - 'actions/upload-artifact@v7.0.1' + - 'houseabsolute/actions-rust-cross@v1.0.8' + - 'softprops/action-gh-release@v3.0.3' + '.github/workflows/verify-lockfile.yml': + - 'actions/checkout@v7.0.1' +dependencies: + 'actions/cache@v5': + ref: 'v5' + commit: 'sha1-caa296126883cff596d87d8935842f9db880ef25' + owner_id: 44036562 + repo_id: 215566462 + 'actions/checkout@v7.0.1': + ref: 'v7.0.1' + commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1' + owner_id: 44036562 + repo_id: 197814629 + 'actions/configure-pages@v6.0.0': + ref: 'v6.0.0' + commit: 'sha1-45bfe0192ca1faeb007ade9deae92b16b8254a0d' + owner_id: 44036562 + repo_id: 513659658 + 'actions/deploy-pages@v5.0.1': + ref: 'v5.0.1' + commit: 'sha1-368f82528645a54fb793d4d04e342629a3f51346' + owner_id: 44036562 + repo_id: 438112499 + 'actions/download-artifact@v8.0.1': + ref: 'v8.0.1' + commit: 'sha1-3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c' + owner_id: 44036562 + repo_id: 192626254 + 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f': + ref: 'v7.0.0' + commit: 'sha1-bbbca2ddaa5d8feaa63e36b76fdaad77386f024f' + owner_id: 44036562 + repo_id: 192625955 + 'actions/upload-artifact@v7.0.1': + ref: 'v7.0.1' + commit: 'sha1-043fb46d1a93c77aae656e7c1c64a875d1fc6a0a' + owner_id: 44036562 + repo_id: 192625955 + 'actions/upload-pages-artifact@v5.0.0': + ref: 'v5.0.0' + commit: 'sha1-fc324d3547104276b827a68afc52ff2a11cc49c9' + owner_id: 44036562 + repo_id: 496012378 + uses: + - 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f' + 'dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de': + ref: 'master' + commit: 'sha1-02cb101ec7c40f2c49e1d9714d64511d8e1b74de' + owner_id: 1940490 + repo_id: 260749683 + 'dtolnay/rust-toolchain@master': + ref: 'master' + commit: 'sha1-683b588c487a69d01f6c6ddf40f036ff682cc2c8' + owner_id: 1940490 + repo_id: 260749683 + 'embarkstudios/cargo-deny-action@v2.1.1': + ref: 'v2.1.1' + commit: 'sha1-3c6349835b2b7b196a839186cb8b78e02f7b5f25' + owner_id: 44887257 + repo_id: 228054692 + 'houseabsolute/actions-rust-cross@v1.0.8': + ref: 'v1.0.8' + commit: 'sha1-21b0f18dc621b25bfae556ff2791fca4173121e8' + owner_id: 9559342 + repo_id: 609930090 + uses: + - 'actions/cache@v5' + - 'dtolnay/rust-toolchain@master' + - 'swatinem/rust-cache@v2' + 'softprops/action-gh-release@v3.0.3': + ref: 'v3.0.3' + commit: 'sha1-efb35369e0ad2afab669f228072c1b0d510eae64' + owner_id: 2242 + repo_id: 204253808 + 'swatinem/rust-cache@v2': + ref: 'v2' + commit: 'sha1-d1527c8f67ef9af357290475d4af4b0fab8f12e0' + owner_id: 580492 + repo_id: 298565987 + 'swatinem/rust-cache@v2.9.2': + ref: 'v2.9.2' + commit: 'sha1-6323deb102c322ba6fcbdcafc7e3dddab59af2b6' + owner_id: 580492 + repo_id: 298565987 diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 4d7976ee..2505f431 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -18,7 +18,7 @@ jobs: msrv: ${{ steps.get-msrv.outputs.msrv }} steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Get MSRV id: get-msrv run: | @@ -34,14 +34,14 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Setup Rust uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # latest commit as of 2026-09-12 with: toolchain: ${{ matrix.versions }} components: rustfmt, clippy - name: Cache - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 + uses: Swatinem/rust-cache@v2.9.2 - name: Version run: | rustc --version @@ -61,7 +61,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Setup Rust uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # latest commit as of 2026-09-12 with: @@ -89,11 +89,11 @@ jobs: runs-on: ${{ matrix.targets.os }} steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Setup run: rustup target add ${{ matrix.targets.target }} - name: Build - uses: houseabsolute/actions-rust-cross@21b0f18dc621b25bfae556ff2791fca4173121e8 # v1.0.8 + uses: houseabsolute/actions-rust-cross@v1.0.8 with: command: build target: ${{ matrix.targets.target }} diff --git a/.github/workflows/deny.yml b/.github/workflows/deny.yml index 2c89be3a..ae79e4d5 100644 --- a/.github/workflows/deny.yml +++ b/.github/workflows/deny.yml @@ -24,8 +24,8 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Check licenses - uses: EmbarkStudios/cargo-deny-action@3c6349835b2b7b196a839186cb8b78e02f7b5f25 # v2.1.1 + uses: EmbarkStudios/cargo-deny-action@v2.1.1 with: command: check licenses diff --git a/.github/workflows/gh-pages.yml b/.github/workflows/gh-pages.yml index 4973267c..ec883ea4 100644 --- a/.github/workflows/gh-pages.yml +++ b/.github/workflows/gh-pages.yml @@ -22,9 +22,9 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Setup Pages - uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0 + uses: actions/configure-pages@v6.0.0 - name: Install mdbook env: MDBOOK_SHA256: 3f28de05dafca9d0f2eab99c662116b0e37b89b1d96a08f8f430b9eeae958cd7 @@ -40,7 +40,7 @@ jobs: run: | mdbook build - name: Upload artifact - uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0 + uses: actions/upload-pages-artifact@v5.0.0 with: path: docs/book @@ -53,4 +53,4 @@ jobs: steps: - name: Deploy to GitHub Pages id: deployment - uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1 + uses: actions/deploy-pages@v5.0.1 diff --git a/.github/workflows/pinact.yml b/.github/workflows/pinact.yml deleted file mode 100644 index 236ac086..00000000 --- a/.github/workflows/pinact.yml +++ /dev/null @@ -1,29 +0,0 @@ -name: Pinact - -on: - push: - branches: - - '*' - paths: - - .github/** - pull_request: - branches: - - master - paths: - - .github/** - -jobs: - pinact: - runs-on: ubuntu-latest - timeout-minutes: 5 - steps: - - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - name: Pinact - uses: suzuki-shunsuke/pinact-action@896d595f299e71d65b9d28349d6956abe144390a # v3.0.0 - with: - skip_push: "true" - fix: "false" - verify: "true" - excludes: | - dtolnay/rust-toolchain diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 61474178..ccb90beb 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -28,11 +28,11 @@ jobs: runs-on: ${{ matrix.targets.os }} steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Setup run: rustup target add ${{ matrix.targets.target }} - name: Build - uses: houseabsolute/actions-rust-cross@21b0f18dc621b25bfae556ff2791fca4173121e8 # v1.0.8 + uses: houseabsolute/actions-rust-cross@v1.0.8 with: command: build target: ${{ matrix.targets.target }} @@ -42,7 +42,7 @@ jobs: - name: Archive run: tar -czf serie-${{ env.RELEASE_VERSION }}-${{ matrix.targets.target }}.tar.gz -C target/${{ matrix.targets.target }}/release serie - name: Upload artifact - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@v7.0.1 with: name: release-${{ matrix.targets.target }} path: serie-${{ env.RELEASE_VERSION }}-${{ matrix.targets.target }}.tar.gz @@ -54,13 +54,13 @@ jobs: needs: build steps: - name: Download artifact - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@v8.0.1 with: path: releases pattern: release-* merge-multiple: true - name: Create Draft Release - uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3 + uses: softprops/action-gh-release@v3.0.3 with: draft: true generate_release_notes: true diff --git a/.github/workflows/verify-lockfile.yml b/.github/workflows/verify-lockfile.yml new file mode 100644 index 00000000..e8d00713 --- /dev/null +++ b/.github/workflows/verify-lockfile.yml @@ -0,0 +1,32 @@ +name: Verify lockfile + +on: + push: + branches: + - '*' + paths: + - .github/** + pull_request: + branches: + - master + paths: + - .github/** + +permissions: + contents: read + +jobs: + verify: + runs-on: ubuntu-latest + timeout-minutes: 5 + env: + GH_TOKEN: ${{ github.token }} + steps: + - name: Checkout + uses: actions/checkout@v7.0.1 + with: + persist-credentials: false + - name: Install actions-lock + run: gh extension install github/gh-actions-lock --pin v0.4.0 + - name: Verify lockfile + run: gh actions-lock --verify From 2f34b576d7b565f08a88ef7a4bcdea4393368c1d Mon Sep 17 00:00:00 2001 From: Kyosuke Fujimoto Date: Sun, 1 Nov 2026 09:32:50 +0900 Subject: [PATCH 2/2] Track Rust toolchain master in the lockfile --- .github/workflows/actions.lock | 7 +------ .github/workflows/build.yml | 4 ++-- 2 files changed, 3 insertions(+), 8 deletions(-) diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index 0edb9f8f..11f01431 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -5,7 +5,7 @@ version: 'v0.0.3' workflows: '.github/workflows/build.yml': - 'actions/checkout@v7.0.1' - - 'dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de' + - 'dtolnay/rust-toolchain@master' - 'houseabsolute/actions-rust-cross@v1.0.8' - 'swatinem/rust-cache@v2.9.2' '.github/workflows/deny.yml': @@ -67,11 +67,6 @@ dependencies: repo_id: 496012378 uses: - 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f' - 'dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de': - ref: 'master' - commit: 'sha1-02cb101ec7c40f2c49e1d9714d64511d8e1b74de' - owner_id: 1940490 - repo_id: 260749683 'dtolnay/rust-toolchain@master': ref: 'master' commit: 'sha1-683b588c487a69d01f6c6ddf40f036ff682cc2c8' diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 2505f431..c2c8e390 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -36,7 +36,7 @@ jobs: - name: Checkout uses: actions/checkout@v7.0.1 - name: Setup Rust - uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # latest commit as of 2026-09-12 + uses: dtolnay/rust-toolchain@master with: toolchain: ${{ matrix.versions }} components: rustfmt, clippy @@ -63,7 +63,7 @@ jobs: - name: Checkout uses: actions/checkout@v7.0.1 - name: Setup Rust - uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # latest commit as of 2026-09-12 + uses: dtolnay/rust-toolchain@master with: toolchain: stable - name: Install cargo-sort-derives