diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 4934ae1..ff300a7 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -22,6 +22,8 @@ updates: github-actions: patterns: - "*" + cooldown: + default-days: 7 # Broker images for the live network suite. Test infrastructure, so the exclusion above # doesn't apply -- nothing here reaches consumers. @@ -43,4 +45,4 @@ updates: groups: broker-images: patterns: - - "*" + - "*" \ No newline at end of file diff --git a/.github/workflows/fuzz.yaml b/.github/workflows/fuzz.yaml index 96872a3..23c273d 100644 --- a/.github/workflows/fuzz.yaml +++ b/.github/workflows/fuzz.yaml @@ -55,10 +55,10 @@ jobs: target: ["packet_decode", "packet_roundtrip", "topics"] steps: - - uses: 'actions/checkout@v7' + - uses: 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' # v7.0.1 - name: Setup Rust (pinned via rust-toolchain.toml) - uses: actions-rust-lang/setup-rust-toolchain@v1 + uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0 with: cache: false rustflags: '' @@ -79,7 +79,7 @@ jobs: rustup target add x86_64-unknown-linux-gnu --toolchain nightly - name: Cache cargo build artifacts - uses: Swatinem/rust-cache@v2 + uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 with: # `fuzz/` is its own workspace; the instrumented build is cache- # incompatible with the gate's plain check, so key it separately. @@ -90,7 +90,7 @@ jobs: # run, save it back. This is what makes fuzzing compound over time rather # than starting cold each run. - name: Restore/persist fuzz corpus - uses: actions/cache@v6 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: fuzz/corpus/${{ matrix.target }} key: fuzz-corpus-${{ matrix.target }}-${{ github.run_id }} @@ -98,7 +98,7 @@ jobs: fuzz-corpus-${{ matrix.target }}- - name: Install cargo-fuzz - uses: taiki-e/install-action@v2 + uses: taiki-e/install-action@d438492cf8a250514fa2d34b30bc3c0dc37c65ff # v2.87.8 with: tool: cargo-fuzz @@ -113,7 +113,7 @@ jobs: # attached to the run for triage and can be committed as a regression test. - name: Upload crash reproducer if: failure() - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: fuzz-crash-${{ matrix.target }} path: fuzz/artifacts/${{ matrix.target }} diff --git a/.github/workflows/network.yaml b/.github/workflows/network.yaml index 9800505..60f718c 100644 --- a/.github/workflows/network.yaml +++ b/.github/workflows/network.yaml @@ -66,12 +66,12 @@ jobs: kubernetes: true steps: - - uses: 'actions/checkout@v7' + - uses: 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' # v7.0.1 # kubectl ships with the runner image; helm is pinned and k3d isn't present at all. - name: Install Helm if: matrix.kubernetes - uses: azure/setup-helm@v5 + uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1 with: version: 'v3.16.3' @@ -84,7 +84,7 @@ jobs: k3d version - name: Setup Rust (pinned via rust-toolchain.toml) - uses: actions-rust-lang/setup-rust-toolchain@v1 + uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0 with: # Swatinem/rust-cache (below) handles caching, including target/. cache: false @@ -93,7 +93,7 @@ jobs: rustflags: '' - name: Cache cargo build artifacts - uses: Swatinem/rust-cache@v2 + uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 with: shared-key: network diff --git a/.github/workflows/nightly.yaml b/.github/workflows/nightly.yaml index a33d8ae..e3174a1 100644 --- a/.github/workflows/nightly.yaml +++ b/.github/workflows/nightly.yaml @@ -57,10 +57,10 @@ jobs: rust: ["1.88", "stable", "beta", "nightly"] steps: - - uses: 'actions/checkout@v7' + - uses: 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' # v7.0.1 - name: Setup Rust (pinned via rust-toolchain.toml) - uses: actions-rust-lang/setup-rust-toolchain@v1 + uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0 with: cache: false # No `-D warnings`: this workflow runs tests across moving toolchains, @@ -71,7 +71,7 @@ jobs: run: rustup toolchain install ${{ matrix.rust }} --profile minimal - name: Cache cargo build artifacts - uses: Swatinem/rust-cache@v2 + uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 with: shared-key: nightly-test-${{ matrix.rust }} @@ -102,10 +102,10 @@ jobs: deps: ["latest", "minimal"] steps: - - uses: 'actions/checkout@v7' + - uses: 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' # v7.0.1 - name: Setup Rust (pinned via rust-toolchain.toml) - uses: actions-rust-lang/setup-rust-toolchain@v1 + uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0 with: cache: false # No `-D warnings` (see the `test` job above). @@ -118,7 +118,7 @@ jobs: run: rustup toolchain install nightly --profile minimal - name: Install cargo tooling - uses: taiki-e/install-action@v2 + uses: taiki-e/install-action@d438492cf8a250514fa2d34b30bc3c0dc37c65ff # v2.87.8 with: tool: cargo-deny diff --git a/.github/workflows/pr.yaml b/.github/workflows/pr.yaml index 380cf88..ec7e6c4 100644 --- a/.github/workflows/pr.yaml +++ b/.github/workflows/pr.yaml @@ -53,10 +53,10 @@ jobs: timeout-minutes: 10 steps: - - uses: 'actions/checkout@v7' + - uses: 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' # v7.0.1 - name: Setup Rust (pinned via rust-toolchain.toml) - uses: actions-rust-lang/setup-rust-toolchain@v1 + uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0 with: # Swatinem/rust-cache (below) handles caching, including target/, # which this action's built-in cache does not. @@ -68,14 +68,14 @@ jobs: rustflags: '' - name: Cache cargo build artifacts - uses: Swatinem/rust-cache@v2 + uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 with: shared-key: check # Install cargo subcommands AFTER the cache restore: Swatinem/rust-cache # caches ~/.cargo/bin, so a warm cache makes this a no-op. - name: Install cargo tooling - uses: taiki-e/install-action@v2 + uses: taiki-e/install-action@d438492cf8a250514fa2d34b30bc3c0dc37c65ff # v2.87.8 with: tool: cargo-machete,cargo-deny @@ -97,10 +97,10 @@ jobs: timeout-minutes: 10 steps: - - uses: 'actions/checkout@v7' + - uses: 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' # v7.0.1 - name: Setup Rust (pinned via rust-toolchain.toml) - uses: actions-rust-lang/setup-rust-toolchain@v1 + uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0 with: cache: false # No `-D warnings`: the fuzz crate isn't held to the library's @@ -108,7 +108,7 @@ jobs: rustflags: '' - name: Cache cargo build artifacts - uses: Swatinem/rust-cache@v2 + uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 with: # `fuzz/` is a separate workspace with its own target/, so point the # cache at it explicitly and key it apart from the library builds. @@ -151,10 +151,10 @@ jobs: deps: ["latest", "minimal"] steps: - - uses: 'actions/checkout@v7' + - uses: 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' # v7.0.1 - name: Setup Rust (pinned via rust-toolchain.toml) - uses: actions-rust-lang/setup-rust-toolchain@v1 + uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0 with: cache: false # No `-D warnings` on the toolchain matrix (see the `check` job). @@ -171,7 +171,7 @@ jobs: run: rustup toolchain install ${{ matrix.rust }} --profile minimal - name: Cache cargo build artifacts - uses: Swatinem/rust-cache@v2 + uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 with: # `deps` is part of the key: latest and minimal builds produce # incompatible target/ artifacts and must not share a cache. @@ -208,17 +208,17 @@ jobs: timeout-minutes: 15 steps: - - uses: 'actions/checkout@v7' + - uses: 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' # v7.0.1 - name: Setup Rust (pinned via rust-toolchain.toml) - uses: actions-rust-lang/setup-rust-toolchain@v1 + uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0 with: cache: false # No `-D warnings` here either (see the `check` job). rustflags: '' - name: Cache cargo build artifacts - uses: Swatinem/rust-cache@v2 + uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 with: # The `__network` feature builds a target the other jobs don't, so keep # its target/ separate from theirs. @@ -247,24 +247,24 @@ jobs: timeout-minutes: 20 steps: - - uses: 'actions/checkout@v7' + - uses: 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' # v7.0.1 - name: Setup Rust (pinned via rust-toolchain.toml) - uses: actions-rust-lang/setup-rust-toolchain@v1 + uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0 with: cache: false # No `-D warnings` on the toolchain matrix (see the `check` job). rustflags: '' - name: Cache cargo build artifacts - uses: Swatinem/rust-cache@v2 + uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 with: # Distinct from the `test` keys: instrumented builds must not share # target/ with them. shared-key: coverage - name: Install cargo tooling - uses: taiki-e/install-action@v2 + uses: taiki-e/install-action@d438492cf8a250514fa2d34b30bc3c0dc37c65ff # v2.87.8 with: tool: cargo-llvm-cov @@ -273,7 +273,7 @@ jobs: run: make network-coverage BROKER=mosquitto - name: Upload coverage report - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: coverage-report path: target/llvm-cov/html