diff --git a/.github/dependabot.yml b/.github/dependabot.yml index b8d4a06..6680c60 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -32,6 +32,15 @@ updates: update-types: ["version-update:semver-major"] # GitHub Actions pinned in the CI / release / npm-publish / mirror workflows. + # + # REVIEWER TRAP: `.github/workflows/release.yml` is GENERATED by cargo-dist and + # is verified against the generator by the `plan` job. Dependabot cannot be + # told to skip a single file, so it will keep proposing action bumps inside + # that file — and `plan` will keep failing them. Do NOT merge such a PR: `plan` + # is also the FIRST job of the real release workflow, so a mismatched + # release.yml breaks the next `vX.Y.Z` tag push, not just the PR. Drop the + # release.yml hunks and keep the rest; the file only changes when + # `cargo-dist-version` is bumped and `dist generate` is re-run. - package-ecosystem: "github-actions" directory: "/" schedule: diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 370b8b2..dd88971 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -56,7 +56,7 @@ jobs: env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v6 with: persist-credentials: false submodules: recursive @@ -116,7 +116,7 @@ jobs: - name: enable windows longpaths run: | git config --global core.longpaths true - - uses: actions/checkout@v7 + - uses: actions/checkout@v6 with: persist-credentials: false submodules: recursive @@ -175,7 +175,7 @@ jobs: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} BUILD_MANIFEST_NAME: target/distrib/global-dist-manifest.json steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v6 with: persist-credentials: false submodules: recursive @@ -225,7 +225,7 @@ jobs: outputs: val: ${{ steps.host.outputs.manifest }} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v6 with: persist-credentials: false submodules: recursive @@ -290,7 +290,7 @@ jobs: GITHUB_EMAIL: "admin+bot@axo.dev" if: ${{ !fromJson(needs.plan.outputs.val).announcement_is_prerelease || fromJson(needs.plan.outputs.val).publish_prereleases }} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v6 with: persist-credentials: true repository: "bugsee/homebrew-tap" @@ -337,7 +337,7 @@ jobs: env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v6 with: persist-credentials: false submodules: recursive diff --git a/CLAUDE.md b/CLAUDE.md index 2769b00..4a3dcfb 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -14,8 +14,11 @@ per-build-system orchestrators shell to it instead of each re-implementing the HTTP / compression / retry / presigned-handshake logic — the Android Gradle plugin (Kotlin), and the iOS SDK + fastlane `BugseeAgent`s (Python). -Binary crate, no library target. Edition 2021, MSRV 1.79 (pinned via -`rust-toolchain.toml`). +Binary crate, no library target. Edition 2021, MSRV 1.88 (declared in +`Cargo.toml`'s `rust-version`). `rust-toolchain.toml` selects `stable`, NOT the +MSRV — and CI builds `stable` too, so nothing in CI catches MSRV drift. A +dependency bump can silently raise the real floor; check with `cargo + +check --all-targets` and update `rust-version` in the same change. ## Commands diff --git a/Cargo.lock b/Cargo.lock index aaf88c3..ce02dc6 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -1,6 +1,6 @@ # This file is automatically @generated by Cargo. # It is not intended for manual editing. -version = 3 +version = 4 [[package]] name = "adler2" @@ -207,7 +207,6 @@ dependencies = [ "futures-util", "globset", "hex", - "indicatif", "libc", "md-5 0.11.0", "plist", @@ -343,18 +342,6 @@ version = "0.4.32" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "cc14f565cf027a105f7a44ccf9e5b424348421a1d8952a8fc9d499d313107789" -[[package]] -name = "console" -version = "0.16.4" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "4fe5f465a4f6fee88fad41b85d990f84c835335e85b5d9e6e63e0d06d28cba7c" -dependencies = [ - "encode_unicode", - "libc", - "unicode-width", - "windows-sys 0.61.2", -] - [[package]] name = "const-oid" version = "0.10.2" @@ -488,12 +475,6 @@ dependencies = [ "stable_deref_trait", ] -[[package]] -name = "encode_unicode" -version = "1.0.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "34aa73646ffb006b8f5147f3dc182bd4bcb190227ce861fc4a4844bf8e3cb2c0" - [[package]] name = "equivalent" version = "1.0.2" @@ -1045,19 +1026,6 @@ dependencies = [ "serde_core", ] -[[package]] -name = "indicatif" -version = "0.18.6" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9433806cd6b4ec1aba79c021c7e4c58fb4c3b9977c085062e611ac929998fb0c" -dependencies = [ - "console", - "portable-atomic", - "unicode-width", - "unit-prefix", - "web-time", -] - [[package]] name = "inplace-vec-builder" version = "0.1.1" @@ -1437,12 +1405,6 @@ dependencies = [ "time", ] -[[package]] -name = "portable-atomic" -version = "1.13.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c33a9471896f1c69cecef8d20cbe2f7accd12527ce60845ff44c153bb2a21b49" - [[package]] name = "potential_utf" version = "0.1.5" @@ -2454,24 +2416,12 @@ version = "1.0.24" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75" -[[package]] -name = "unicode-width" -version = "0.2.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b4ac048d71ede7ee76d585517add45da530660ef4390e49b098733c6e897f254" - [[package]] name = "unicode-xid" version = "0.2.6" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "ebc1c04c71510c7f702b52b7c350734c9ff1295c464a03335b00bb84fc54f853" -[[package]] -name = "unit-prefix" -version = "0.5.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "81e544489bf3d8ef66c953931f56617f423cd4b5494be343d9b9d3dda037b9a3" - [[package]] name = "untrusted" version = "0.9.0" diff --git a/Cargo.toml b/Cargo.toml index 4d6c0ae..0ad4311 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -2,7 +2,10 @@ name = "bugsee-cli" version = "0.7.4" edition = "2021" -rust-version = "1.79" +# Real floor, not an aspiration: the locked tree requires 1.88 (`gimli`, +# `globset`, `plist`, `time`). Verify a bump with `cargo + check +# --all-targets` — CI builds `stable`, so it will NOT catch MSRV drift. +rust-version = "1.88" authors = ["Bugsee"] description = "Bugsee CLI — cross-platform symbol collection, conversion, and upload." readme = "README.md" @@ -116,7 +119,6 @@ anyhow = "1" thiserror = "2" tracing = "0.1" tracing-subscriber = { version = "0.3", features = ["env-filter", "fmt"] } -indicatif = "0.18" tempfile = "3" # In-place self-replacement of the running executable for `bugsee-cli update`.