ci: standardize validation and centralize tool pins

.github/actions/setup-just/action.yml

@@ -0,0 +1,51 @@
+name: Set up just
+description: Resolve the pinned just version from justfile and install it.
+
+outputs:
+  version:
+    description: Resolved just version from justfile.
+    value: ${{ steps.resolve.outputs.version }}
+
+runs:
+  using: composite
+  steps:
+    - name: Resolve just version
+      id: resolve
+      shell: bash
+      run: |
+        set -euo pipefail
+        shopt -s extglob
+
+        version=""
+        declaration_re='^[[:space:]]*just_version[[:space:]]*:=[[:space:]]*(.*)$'
+        while IFS= read -r line; do
+          if [[ "$line" =~ $declaration_re ]]; then
+            value="${BASH_REMATCH[1]}"
+            value="${value%%#*}"
+            value="${value##+([[:space:]])}"
+            value="${value%%+([[:space:]])}"
+
+            if [[ ${#value} -ge 2 ]]; then
+              first="${value:0:1}"
+              last="${value: -1}"
+              if [[ "$first" == "$last" && ( "$first" == '"' || "$first" == "'" ) ]]; then
+                value="${value:1:${#value}-2}"
+              fi
+            fi
+
+            version="$value"
+            break
+          fi
+        done < justfile
+
+        if [[ -z "$version" ]]; then
+          echo "::error::Could not resolve just_version from justfile"
+          exit 1
+        fi
+
+        echo "version=$version" >> "$GITHUB_OUTPUT"
+
+    - name: Install just
+      uses: taiki-e/cache-cargo-install-action@417450f3c33ee20393705369577571770643d4c7 # v3.0.7
+      with:
+        tool: just@${{ steps.resolve.outputs.version }}

.github/dependabot.yml

@@ -5,6 +5,9 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+      day: "monday"
+      time: "03:00"
+      timezone: "America/Los_Angeles"
     cooldown:
       default-days: 7
     open-pull-requests-limit: 10
@@ -21,6 +24,9 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+      day: "monday"
+      time: "04:00"
+      timezone: "America/Los_Angeles"
     cooldown:
       default-days: 7
     open-pull-requests-limit: 10
@@ -38,6 +44,9 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+      day: "monday"
+      time: "05:00"
+      timezone: "America/Los_Angeles"
     cooldown:
       default-days: 7
     open-pull-requests-limit: 10

.github/workflows/audit.yml

@@ -87,7 +87,7 @@ jobs:
             github.event_name != 'pull_request' ||
             github.event.pull_request.head.repo.full_name == github.repository
           )
-        uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
+        uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
         with:
           sarif_file: audit-results.sarif
           category: cargo-audit

.github/workflows/benchmarks.yml

@@ -23,6 +23,7 @@ on:
       - "Cargo.lock"
       - "justfile"
       - "rust-toolchain.toml"
+      - ".github/actions/setup-just/action.yml"
       - ".github/workflows/benchmarks.yml"
   pull_request:
     branches:
@@ -37,6 +38,7 @@ on:
       - "Cargo.lock"
       - "justfile"
       - "rust-toolchain.toml"
+      - ".github/actions/setup-just/action.yml"
       - ".github/workflows/benchmarks.yml"
   workflow_dispatch:
 
@@ -69,21 +71,21 @@ jobs:
           cache: true
           cache-bin: false
 
-      - name: Read just version
-        id: just_version
-        run: |
-          version="$(grep '^just_version :=' justfile | cut -d '"' -f 2)"
-          echo "version=$version" >> "$GITHUB_OUTPUT"
-
-      - name: Install just
-        uses: taiki-e/cache-cargo-install-action@417450f3c33ee20393705369577571770643d4c7 # v3.0.7
-        with:
-          tool: just@${{ steps.just_version.outputs.version }}
+      - name: Set up just
+        uses: ./.github/actions/setup-just
 
-      - name: Read cargo-nextest version
+      - name: Resolve cargo-nextest version
         id: cargo_nextest_version
+        shell: bash
         run: |
+          set -euo pipefail
+
           version="$(just --evaluate cargo_nextest_version)"
+          if [[ -z "$version" ]]; then
+            echo "::error::Could not resolve cargo_nextest_version from justfile"
+            exit 1
+          fi
+
           echo "version=$version" >> "$GITHUB_OUTPUT"
 
       - name: Install cargo-nextest

.github/workflows/ci.yml

@@ -63,31 +63,49 @@ jobs:
           cache-bin: false
           # toolchain, components, etc. are specified in rust-toolchain.toml
 
-      - name: Read just version
-        id: just_version
-        shell: bash
-        run: |
-          version="$(grep '^just_version :=' justfile | cut -d '"' -f 2)"
-          echo "version=$version" >> "$GITHUB_OUTPUT"
-
-      - name: Install just
-        uses: taiki-e/cache-cargo-install-action@417450f3c33ee20393705369577571770643d4c7 # v3.0.7
-        with:
-          tool: just@${{ steps.just_version.outputs.version }}
+      - name: Set up just
+        uses: ./.github/actions/setup-just
 
       - name: Export tool versions
         id: tool_versions
         shell: bash
         run: |
+          set -euo pipefail
+
+          resolve_version() {
+            local name="$1"
+            local value
+
+            if ! value="$(just --evaluate "$name")"; then
+              echo "::error::Failed to resolve $name from justfile" >&2
+              return 1
+            fi
+            if [[ -z "$value" ]]; then
+              echo "::error::Resolved empty $name from justfile" >&2
+              return 1
+            fi
+
+            printf '%s\n' "$value"
+          }
+
+          cargo_machete_version="$(resolve_version cargo_machete_version)"
+          cargo_nextest_version="$(resolve_version cargo_nextest_version)"
+          dprint_version="$(resolve_version dprint_version)"
+          rumdl_version="$(resolve_version rumdl_version)"
+          taplo_version="$(resolve_version taplo_version)"
+          typos_version="$(resolve_version typos_version)"
+          uv_version="$(resolve_version uv_version)"
+          zizmor_version="$(resolve_version zizmor_version)"
+
           {
-            echo "CARGO_MACHETE_VERSION=$(just --evaluate cargo_machete_version)"
-            echo "CARGO_NEXTEST_VERSION=$(just --evaluate cargo_nextest_version)"
-            echo "DPRINT_VERSION=$(just --evaluate dprint_version)"
-            echo "RUMDL_VERSION=$(just --evaluate rumdl_version)"
-            echo "TAPLO_VERSION=$(just --evaluate taplo_version)"
-            echo "TYPOS_VERSION=$(just --evaluate typos_version)"
-            echo "UV_VERSION=$(just --evaluate uv_version)"
-            echo "ZIZMOR_VERSION=$(just --evaluate zizmor_version)"
+            echo "CARGO_MACHETE_VERSION=$cargo_machete_version"
+            echo "CARGO_NEXTEST_VERSION=$cargo_nextest_version"
+            echo "DPRINT_VERSION=$dprint_version"
+            echo "RUMDL_VERSION=$rumdl_version"
+            echo "TAPLO_VERSION=$taplo_version"
+            echo "TYPOS_VERSION=$typos_version"
+            echo "UV_VERSION=$uv_version"
+            echo "ZIZMOR_VERSION=$zizmor_version"
           } >> "$GITHUB_OUTPUT"
 
       - name: Set up Python

.github/workflows/codecov.yml

@@ -31,23 +31,37 @@ jobs:
           cache: true # toolchain/components are specified in rust-toolchain.toml
           cache-bin: false
 
-      - name: Read just version
-        id: just_version
-        run: |
-          version="$(grep '^just_version :=' justfile | cut -d '"' -f 2)"
-          echo "version=$version" >> "$GITHUB_OUTPUT"
-
-      - name: Install just
-        uses: taiki-e/cache-cargo-install-action@417450f3c33ee20393705369577571770643d4c7 # v3.0.7
-        with:
-          tool: just@${{ steps.just_version.outputs.version }}
+      - name: Set up just
+        uses: ./.github/actions/setup-just
 
       - name: Export coverage tool versions
         id: tool_versions
+        shell: bash
         run: |
+          set -euo pipefail
+
+          resolve_version() {
+            local name="$1"
+            local value
+
+            if ! value="$(just --evaluate "$name")"; then
+              echo "::error::Failed to resolve $name from justfile" >&2
+              return 1
+            fi
+            if [[ -z "$value" ]]; then
+              echo "::error::Resolved empty $name from justfile" >&2
+              return 1
+            fi
+
+            printf '%s\n' "$value"
+          }
+
+          cargo_llvm_cov_version="$(resolve_version cargo_llvm_cov_version)"
+          cargo_nextest_version="$(resolve_version cargo_nextest_version)"
+
           {
-            echo "CARGO_LLVM_COV_VERSION=$(just --evaluate cargo_llvm_cov_version)"
-            echo "CARGO_NEXTEST_VERSION=$(just --evaluate cargo_nextest_version)"
+            echo "CARGO_LLVM_COV_VERSION=$cargo_llvm_cov_version"
+            echo "CARGO_NEXTEST_VERSION=$cargo_nextest_version"
           } >> "$GITHUB_OUTPUT"
 
       - name: Install LLVM coverage tools

.github/workflows/codeql.yml

@@ -35,20 +35,20 @@ jobs:
 
       - name: Initialize CodeQL
         if: matrix.language != 'rust'
-        uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
+        uses: github/codeql-action/init@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
         with:
           languages: ${{ matrix.language }}
           queries: security-extended
 
       - name: Initialize CodeQL (Rust)
         if: matrix.language == 'rust'
-        uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
+        uses: github/codeql-action/init@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
         with:
           languages: ${{ matrix.language }}
           build-mode: none
           queries: security-extended
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
+        uses: github/codeql-action/analyze@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
         with:
           category: "/language:${{ matrix.language }}"

.github/workflows/release-benchmarks.yml

@@ -38,14 +38,27 @@ jobs:
         with:
           cache: false
 
-      - name: Install benchmark validation tools
+      - name: Set up just
+        uses: ./.github/actions/setup-just
+
+      - name: Resolve cargo-nextest version
+        id: cargo_nextest_version
+        shell: bash
         run: |
           set -euo pipefail
 
-          just_version="$(grep '^just_version :=' justfile | cut -d '"' -f 2)"
-          cargo install --locked just --version "$just_version"
-          nextest_version="$(just --evaluate cargo_nextest_version)"
-          cargo install --locked cargo-nextest --version "$nextest_version"
+          version="$(just --evaluate cargo_nextest_version)"
+          if [[ -z "$version" ]]; then
+            echo "::error::Could not resolve cargo_nextest_version from justfile"
+            exit 1
+          fi
+
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+
+      - name: Install cargo-nextest
+        uses: taiki-e/cache-cargo-install-action@417450f3c33ee20393705369577571770643d4c7 # v3.0.7
+        with:
+          tool: cargo-nextest@${{ steps.cargo_nextest_version.outputs.version }}
 
       - name: Validate benchmark inputs
         run: just test-bench-inputs

.github/workflows/rust-clippy.yml

@@ -28,9 +28,6 @@ jobs:
   clippy-sarif:
     name: Clippy SARIF Analysis
     runs-on: ubuntu-latest
-    env:
-      CLIPPY_SARIF_VERSION: "0.8.0"
-      SARIF_FMT_VERSION: "0.8.0"
     steps:
       - name: Checkout code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -43,15 +40,48 @@ jobs:
           cache: true # toolchain/components are specified in rust-toolchain.toml
           cache-bin: false
 
+      - name: Set up just
+        uses: ./.github/actions/setup-just
+
+      - name: Export tool versions
+        id: tool_versions
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          resolve_version() {
+            local name="$1"
+            local value
+
+            if ! value="$(just --evaluate "$name")"; then
+              echo "::error::Failed to resolve $name from justfile" >&2
+              return 1
+            fi
+            if [[ -z "$value" ]]; then
+              echo "::error::Resolved empty $name from justfile" >&2
+              return 1
+            fi
+
+            printf '%s\n' "$value"
+          }
+
+          clippy_sarif_version="$(resolve_version clippy_sarif_version)"
+          sarif_fmt_version="$(resolve_version sarif_fmt_version)"
+
+          {
+            echo "CLIPPY_SARIF_VERSION=$clippy_sarif_version"
+            echo "SARIF_FMT_VERSION=$sarif_fmt_version"
+          } >> "$GITHUB_OUTPUT"
+
       - name: Install clippy-sarif
         uses: taiki-e/cache-cargo-install-action@417450f3c33ee20393705369577571770643d4c7 # v3.0.7
         with:
-          tool: clippy-sarif@${{ env.CLIPPY_SARIF_VERSION }}
+          tool: clippy-sarif@${{ steps.tool_versions.outputs.CLIPPY_SARIF_VERSION }}
 
       - name: Install sarif-fmt
         uses: taiki-e/cache-cargo-install-action@417450f3c33ee20393705369577571770643d4c7 # v3.0.7
         with:
-          tool: sarif-fmt@${{ env.SARIF_FMT_VERSION }}
+          tool: sarif-fmt@${{ steps.tool_versions.outputs.SARIF_FMT_VERSION }}
 
       - name: Run clippy with SARIF output
         run: |
@@ -74,7 +104,7 @@ jobs:
             github.event_name != 'pull_request'
             || github.event.pull_request.head.repo.full_name == github.repository
           )
-        uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
+        uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
         with:
           sarif_file: rust-clippy-results.sarif
           category: "clippy"