From 93e831afe4e0770fe3c997fab212cda84246bb31 Mon Sep 17 00:00:00 2001 From: bordumb Date: Mon, 3 Aug 2026 14:23:28 +0100 Subject: [PATCH 1/2] Enforce public Rustdoc before release Signed-off-by: bordumb Auths-Id: did:keri:EMN-WRXNAkLfavKsaFHS0ehP7eB1s8a1alktBJoDhI7b Auths-Device: did:keri:EAswoxxXY6-kXqYcc3mUngY8GOiwhDwXxFfjWXzCvuW6 Auths-Anchor-Seq: 1 --- formal/qualification/aeneas/source-closure.json | 4 ++-- product/policy/auths-bounded-policy/src/lib.rs | 6 +++--- release/semantic-freeze.json | 14 +++++++------- xtask/src/checks.rs | 16 ++++++++++++++++ xtask/src/release.rs | 9 --------- xtask/src/semantic_freeze.rs | 8 ++++---- 6 files changed, 32 insertions(+), 25 deletions(-) diff --git a/formal/qualification/aeneas/source-closure.json b/formal/qualification/aeneas/source-closure.json index 7db6cfa..80fd66c 100644 --- a/formal/qualification/aeneas/source-closure.json +++ b/formal/qualification/aeneas/source-closure.json @@ -1,6 +1,6 @@ { "schema": "auths-proof-translation-source-closure/v2", - "digest": "349a21811a328f934693058f1db1c00f7a61ff965d5008d51edc3c18909acd6a", + "digest": "b26371ada3c58adb5999f5e15bff34df8f21a8aaf2d4b9bda15cd8d725c49eab", "files": [ { "path": "Cargo.lock", @@ -62,7 +62,7 @@ }, { "path": "product/policy/auths-bounded-policy/src/lib.rs", - "sha256": "7480d654aec562478396bf9b00d52af3e7d6ef956a8fd5d6b13deb66836fe9a3" + "sha256": "76a18638b810e62e594d6e951504679305ce21841388e0c282ad51cd7841b91c" }, { "path": "product/runtime/auths-lifecycle/Cargo.toml", diff --git a/product/policy/auths-bounded-policy/src/lib.rs b/product/policy/auths-bounded-policy/src/lib.rs index 8cec78e..c562850 100644 --- a/product/policy/auths-bounded-policy/src/lib.rs +++ b/product/policy/auths-bounded-policy/src/lib.rs @@ -21,11 +21,11 @@ pub use arithmetic::{ ArithmeticError, BasisPoints, RoundingDirection, UnitQuantity, checked_basis_points, }; pub use commitment::{ - ConfigurationCommitmentV1, ConfigurationMatch, EvaluationCommitmentsV1, PolicyCommitmentV1, - configuration_match, + CommitmentError, ConfigurationCommitmentV1, ConfigurationMatch, EvaluationCommitmentsV1, + PolicyCommitmentV1, configuration_match, }; pub use eligibility::{ - BoundedOutputs, EligibilityV1, ObligationClass, ObligationCommitmentV1, + BoundedOutputs, EligibilityV1, ObligationClass, ObligationCommitmentV1, OutputError, ReservationIntentCommitmentV1, ReservationKind, ValidationWork, }; pub use identifier::{ diff --git a/release/semantic-freeze.json b/release/semantic-freeze.json index 53d5233..7a0c82e 100644 --- a/release/semantic-freeze.json +++ b/release/semantic-freeze.json @@ -1,6 +1,6 @@ { "schema": "auths.semantic-freeze/1", - "freezeVersion": 8, + "freezeVersion": 10, "publicSurface": { "rustRoots": [ "auths", @@ -187,7 +187,7 @@ }, { "id": "auths.frozen-bytes/formal/qualification/aeneas/source-closure.json", - "version": 5, + "version": 6, "classification": "frozen-bytes", "categories": [ "canonical-generated-evidence" @@ -195,7 +195,7 @@ "owners": [ "formal/qualification/aeneas/source-closure.json" ], - "sha256": "c43a63873e89bb539affd6b0e24644b61ae9c7d62d1a5f687d4d1a118e100755" + "sha256": "0c3f8a472e3dda0be9a39b35b7fd0a297fe537b0bf43f84ca7b927c2101e8392" }, { "id": "auths.frozen-bytes/product/fixtures/v1/bounded-policy/manifest.json", @@ -492,7 +492,7 @@ }, { "id": "auths.product.bounded-policy", - "version": 1, + "version": 2, "classification": "frozen-meaning", "categories": [ "policy-semantic-ids", @@ -503,7 +503,7 @@ "product/fixtures/v1/bounded-policy/registry.toml", "product/policy/auths-bounded-policy/src" ], - "sha256": "3c9c768053d86461db1122a3a048c8e882ecbf95c0fd0e2fa46ac5436a422bc6" + "sha256": "016fda0634a31edeed423a1b81220d66fe9034ef76234ef4c71db688bfbdb1d4" }, { "id": "auths.product.configuration-commitments", @@ -592,7 +592,7 @@ }, { "id": "auths.release.public-surface", - "version": 8, + "version": 10, "classification": "release-metadata", "categories": [ "package-names", @@ -659,7 +659,7 @@ "xtask/src/release_control.rs", "xtask/src/semantic_freeze.rs" ], - "sha256": "23af939d2c03e962407ed0049d7ce2aee2b4bfde4fc50c60a7213f68868c5429" + "sha256": "76ce356b5cb6c4863638d49c7d71422fec6638bbf4d71e5d956ad69189d1e55c" } ] } diff --git a/xtask/src/checks.rs b/xtask/src/checks.rs index 2e6d241..6a739a8 100644 --- a/xtask/src/checks.rs +++ b/xtask/src/checks.rs @@ -26,12 +26,28 @@ pub(crate) fn ci_authoritative() -> Result<(), String> { "-D", "warnings", ])?; + release_documentation()?; core_boundary()?; workspace_msrv()?; platform_artifact(&root().join("target/release-evidence/platform.json"))?; fuzz_smoke() } +pub(crate) fn release_documentation() -> Result<(), String> { + let status = Command::new("cargo") + .args(["doc", "--workspace", "--all-features", "--no-deps"]) + .env("RUSTDOCFLAGS", "-D warnings") + .current_dir(root()) + .status() + .map_err(|error| format!("could not build release documentation: {error}"))?; + if status.success() { + println!("release documentation passed"); + Ok(()) + } else { + Err(format!("documentation build failed with {status}")) + } +} + pub(crate) fn ci_compliance() -> Result<(), String> { let compliance_inventory = compliance_inventory()?; abi()?; diff --git a/xtask/src/release.rs b/xtask/src/release.rs index 70859e5..dce6052 100644 --- a/xtask/src/release.rs +++ b/xtask/src/release.rs @@ -144,15 +144,6 @@ pub(crate) fn release_check() -> Result<(), String> { ci()?; cargo(&["test", "--workspace", "--no-default-features"])?; wire(false)?; - let status = Command::new("cargo") - .args(["doc", "--workspace", "--all-features", "--no-deps"]) - .env("RUSTDOCFLAGS", "-D warnings") - .current_dir(root()) - .status() - .map_err(|error| format!("could not build release documentation: {error}"))?; - if !status.success() { - return Err(format!("documentation build failed with {status}")); - } package_check()?; release_evidence()?; println!("release checks passed"); diff --git a/xtask/src/semantic_freeze.rs b/xtask/src/semantic_freeze.rs index 1b748ff..1c34716 100644 --- a/xtask/src/semantic_freeze.rs +++ b/xtask/src/semantic_freeze.rs @@ -4,7 +4,7 @@ use crate::*; const INVENTORY_PATH: &str = "release/semantic-freeze.json"; const INVENTORY_SCHEMA: &str = "auths.semantic-freeze/1"; -const FREEZE_VERSION: u64 = 8; +const FREEZE_VERSION: u64 = 10; const PUBLIC_RUST_ROOTS: [&str; 2] = ["auths", "auths-sdk"]; const PUBLIC_RUST_CLOSURE: [&str; 28] = [ "auths", @@ -192,7 +192,7 @@ fn generate_inventory() -> Result { )?, freeze_entry( "auths.product.bounded-policy", - 1, + 2, FreezeClassification::FrozenMeaning, &[ "policy-semantic-ids", @@ -279,7 +279,7 @@ fn generate_inventory() -> Result { for (id, path) in frozen_byte_inventories()? { let version = match path.as_str() { "architecture/dependency-graph.json" => 2, - "formal/qualification/aeneas/source-closure.json" => 5, + "formal/qualification/aeneas/source-closure.json" => 6, _ => 1, }; entries.push(freeze_entry( @@ -321,7 +321,7 @@ fn generate_inventory() -> Result { ]); entries.push(freeze_entry( "auths.release.public-surface", - 8, + 10, FreezeClassification::ReleaseMetadata, &[ "package-names", From 0f2939e8d0aba49b9615f23c7b1c6e68ba3fe5d5 Mon Sep 17 00:00:00 2001 From: bordumb Date: Mon, 3 Aug 2026 14:42:35 +0100 Subject: [PATCH 2/2] Remove Docker dependency from cargo deny Signed-off-by: bordumb Auths-Id: did:keri:EMN-WRXNAkLfavKsaFHS0ehP7eB1s8a1alktBJoDhI7b Auths-Device: did:keri:EAswoxxXY6-kXqYcc3mUngY8GOiwhDwXxFfjWXzCvuW6 Auths-Anchor-Seq: 1 --- .github/workflows/ci.yml | 8 +++++++- .github/workflows/release-builder.yml | 8 +++++++- release/semantic-freeze.json | 6 +++--- xtask/src/semantic_freeze.rs | 4 ++-- 4 files changed, 19 insertions(+), 7 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 018ea37..53b5b23 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -282,7 +282,13 @@ jobs: with: toolchain: 1.97.1 compiler-cache: "false" - - uses: EmbarkStudios/cargo-deny-action@3c6349835b2b7b196a839186cb8b78e02f7b5f25 # v2 + - name: Install pinned cargo-deny + run: | + if [[ "$(cargo deny --version 2>/dev/null || true)" != "cargo-deny 0.20.2" ]]; then + cargo install cargo-deny --version 0.20.2 --locked + fi + - name: Enforce dependency policy + run: cargo deny check - name: Record dependency telemetry if: always() uses: ./.github/actions/phase-telemetry diff --git a/.github/workflows/release-builder.yml b/.github/workflows/release-builder.yml index 6d7ac3c..66e816c 100644 --- a/.github/workflows/release-builder.yml +++ b/.github/workflows/release-builder.yml @@ -141,7 +141,13 @@ jobs: AUTHS_AENEAS_BIN: ${{ github.workspace }}/target/formal-tools/bin/aeneas AUTHS_CHARON_BIN: ${{ github.workspace }}/target/formal-tools/bin/charon run: cargo xtask formal qualify aeneas - - uses: EmbarkStudios/cargo-deny-action@3c6349835b2b7b196a839186cb8b78e02f7b5f25 # v2 + - name: Install pinned cargo-deny + run: | + if [[ "$(cargo deny --version 2>/dev/null || true)" != "cargo-deny 0.20.2" ]]; then + cargo install cargo-deny --version 0.20.2 --locked + fi + - name: Enforce dependency policy + run: cargo deny check - name: Generate signed SLSA provenance for exact subjects id: attest uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4.2.0 diff --git a/release/semantic-freeze.json b/release/semantic-freeze.json index 7a0c82e..0f539e5 100644 --- a/release/semantic-freeze.json +++ b/release/semantic-freeze.json @@ -1,6 +1,6 @@ { "schema": "auths.semantic-freeze/1", - "freezeVersion": 10, + "freezeVersion": 11, "publicSurface": { "rustRoots": [ "auths", @@ -592,7 +592,7 @@ }, { "id": "auths.release.public-surface", - "version": 10, + "version": 11, "classification": "release-metadata", "categories": [ "package-names", @@ -659,7 +659,7 @@ "xtask/src/release_control.rs", "xtask/src/semantic_freeze.rs" ], - "sha256": "76ce356b5cb6c4863638d49c7d71422fec6638bbf4d71e5d956ad69189d1e55c" + "sha256": "6a3fc5e05f10d97a721ad899045234944d78b3647af66d66869d1683fdfe8530" } ] } diff --git a/xtask/src/semantic_freeze.rs b/xtask/src/semantic_freeze.rs index 1c34716..0dc3bb7 100644 --- a/xtask/src/semantic_freeze.rs +++ b/xtask/src/semantic_freeze.rs @@ -4,7 +4,7 @@ use crate::*; const INVENTORY_PATH: &str = "release/semantic-freeze.json"; const INVENTORY_SCHEMA: &str = "auths.semantic-freeze/1"; -const FREEZE_VERSION: u64 = 10; +const FREEZE_VERSION: u64 = 11; const PUBLIC_RUST_ROOTS: [&str; 2] = ["auths", "auths-sdk"]; const PUBLIC_RUST_CLOSURE: [&str; 28] = [ "auths", @@ -321,7 +321,7 @@ fn generate_inventory() -> Result { ]); entries.push(freeze_entry( "auths.release.public-surface", - 10, + 11, FreezeClassification::ReleaseMetadata, &[ "package-names",