From b6a25bb0e19a54c3be86e15979be98f56680f2df Mon Sep 17 00:00:00 2001 From: Alexey Karimov Date: Mon, 24 Aug 2026 18:17:26 +0500 Subject: [PATCH 1/3] fix(release): restore dist-generated release.yml to unbreak tag releases MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The github-actions dependabot PR (#1) hand-edited six `actions/checkout@v6` -> `@v7` lines inside `.github/workflows/release.yml`. That file is GENERATED by cargo-dist, and the `plan` job verifies it against the generator, so `dist plan` has been failing on main ever since. This was not merely a red check. `plan` is also the FIRST job of the real release workflow, so the next `vX.Y.Z` tag push would have failed to release before building a single artefact. There is no upgrade path out of it: cargo-dist 0.32.0 (the pinned version) is the latest published release on both crates.io and upstream GitHub, and no released version emits `checkout@v7`. So the fix is to regenerate the file — `dist generate` reverts exactly those six lines and nothing else. `dist plan` now exits 0 and emits the full plan for all five target triples. The `@v7` bumps in the five hand-written workflows are untouched and fine. Dependabot cannot be told to skip a single file, so it will keep proposing this every week. Documented the trap in dependabot.yml for the next reviewer. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --- .github/dependabot.yml | 9 +++++++++ .github/workflows/release.yml | 12 ++++++------ 2 files changed, 15 insertions(+), 6 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index b8d4a06..6680c60 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -32,6 +32,15 @@ updates: update-types: ["version-update:semver-major"] # GitHub Actions pinned in the CI / release / npm-publish / mirror workflows. + # + # REVIEWER TRAP: `.github/workflows/release.yml` is GENERATED by cargo-dist and + # is verified against the generator by the `plan` job. Dependabot cannot be + # told to skip a single file, so it will keep proposing action bumps inside + # that file — and `plan` will keep failing them. Do NOT merge such a PR: `plan` + # is also the FIRST job of the real release workflow, so a mismatched + # release.yml breaks the next `vX.Y.Z` tag push, not just the PR. Drop the + # release.yml hunks and keep the rest; the file only changes when + # `cargo-dist-version` is bumped and `dist generate` is re-run. - package-ecosystem: "github-actions" directory: "/" schedule: diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 370b8b2..dd88971 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -56,7 +56,7 @@ jobs: env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v6 with: persist-credentials: false submodules: recursive @@ -116,7 +116,7 @@ jobs: - name: enable windows longpaths run: | git config --global core.longpaths true - - uses: actions/checkout@v7 + - uses: actions/checkout@v6 with: persist-credentials: false submodules: recursive @@ -175,7 +175,7 @@ jobs: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} BUILD_MANIFEST_NAME: target/distrib/global-dist-manifest.json steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v6 with: persist-credentials: false submodules: recursive @@ -225,7 +225,7 @@ jobs: outputs: val: ${{ steps.host.outputs.manifest }} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v6 with: persist-credentials: false submodules: recursive @@ -290,7 +290,7 @@ jobs: GITHUB_EMAIL: "admin+bot@axo.dev" if: ${{ !fromJson(needs.plan.outputs.val).announcement_is_prerelease || fromJson(needs.plan.outputs.val).publish_prereleases }} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v6 with: persist-credentials: true repository: "bugsee/homebrew-tap" @@ -337,7 +337,7 @@ jobs: env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v6 with: persist-credentials: false submodules: recursive From b06e7be438840adbdd3aebd81c27a5a32eb34d56 Mon Sep 17 00:00:00 2001 From: Alexey Karimov Date: Mon, 24 Aug 2026 18:17:57 +0500 Subject: [PATCH 2/3] chore(deps): drop unused indicatif dependency MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `indicatif` was declared but referenced nowhere. Verified three ways before removing: a case-insensitive repo-wide search hits only the Cargo.toml line itself; a search for every public API symbol it exposes (ProgressBar, ProgressStyle, MultiProgress, ProgressDrawTarget, HumanBytes, HumanDuration, ProgressIterator, ...) returns nothing; and `cargo check --all-targets` compiles clean without it. It was pure dead weight — build time, supply-chain surface, and a recurring dependabot PR (#6 was a no-op 0.17 -> 0.18 bump on code we never call). Prunes 6 crates from the lock: indicatif, console, encode_unicode, portable-atomic, unicode-width, unit-prefix. Progress reporting, if it ever lands, goes to stderr via `tracing` anyway — stdout is reserved for structured output. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --- Cargo.lock | 52 +--------------------------------------------------- Cargo.toml | 1 - 2 files changed, 1 insertion(+), 52 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index aaf88c3..ce02dc6 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -1,6 +1,6 @@ # This file is automatically @generated by Cargo. # It is not intended for manual editing. -version = 3 +version = 4 [[package]] name = "adler2" @@ -207,7 +207,6 @@ dependencies = [ "futures-util", "globset", "hex", - "indicatif", "libc", "md-5 0.11.0", "plist", @@ -343,18 +342,6 @@ version = "0.4.32" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "cc14f565cf027a105f7a44ccf9e5b424348421a1d8952a8fc9d499d313107789" -[[package]] -name = "console" -version = "0.16.4" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "4fe5f465a4f6fee88fad41b85d990f84c835335e85b5d9e6e63e0d06d28cba7c" -dependencies = [ - "encode_unicode", - "libc", - "unicode-width", - "windows-sys 0.61.2", -] - [[package]] name = "const-oid" version = "0.10.2" @@ -488,12 +475,6 @@ dependencies = [ "stable_deref_trait", ] -[[package]] -name = "encode_unicode" -version = "1.0.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "34aa73646ffb006b8f5147f3dc182bd4bcb190227ce861fc4a4844bf8e3cb2c0" - [[package]] name = "equivalent" version = "1.0.2" @@ -1045,19 +1026,6 @@ dependencies = [ "serde_core", ] -[[package]] -name = "indicatif" -version = "0.18.6" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9433806cd6b4ec1aba79c021c7e4c58fb4c3b9977c085062e611ac929998fb0c" -dependencies = [ - "console", - "portable-atomic", - "unicode-width", - "unit-prefix", - "web-time", -] - [[package]] name = "inplace-vec-builder" version = "0.1.1" @@ -1437,12 +1405,6 @@ dependencies = [ "time", ] -[[package]] -name = "portable-atomic" -version = "1.13.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c33a9471896f1c69cecef8d20cbe2f7accd12527ce60845ff44c153bb2a21b49" - [[package]] name = "potential_utf" version = "0.1.5" @@ -2454,24 +2416,12 @@ version = "1.0.24" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75" -[[package]] -name = "unicode-width" -version = "0.2.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b4ac048d71ede7ee76d585517add45da530660ef4390e49b098733c6e897f254" - [[package]] name = "unicode-xid" version = "0.2.6" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "ebc1c04c71510c7f702b52b7c350734c9ff1295c464a03335b00bb84fc54f853" -[[package]] -name = "unit-prefix" -version = "0.5.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "81e544489bf3d8ef66c953931f56617f423cd4b5494be343d9b9d3dda037b9a3" - [[package]] name = "untrusted" version = "0.9.0" diff --git a/Cargo.toml b/Cargo.toml index 4d6c0ae..b290ed2 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -116,7 +116,6 @@ anyhow = "1" thiserror = "2" tracing = "0.1" tracing-subscriber = { version = "0.3", features = ["env-filter", "fmt"] } -indicatif = "0.18" tempfile = "3" # In-place self-replacement of the running executable for `bugsee-cli update`. From 9a429f64e0024bdd87178912061daacc0364ad5e Mon Sep 17 00:00:00 2001 From: Alexey Karimov Date: Mon, 24 Aug 2026 18:18:05 +0500 Subject: [PATCH 3/3] fix(cargo): correct rust-version to the real 1.88 floor MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `rust-version = "1.79"` was false, and had been for a while — it predates the recent dependency batch. Verified empirically rather than by inference: `cargo +1.88 check --all-targets` succeeds, `cargo +1.85` and `cargo +1.86` both fail, with `gimli` and `globset` naming 1.88 (plus `plist` and `time`). Nothing catches this class of drift: `rust-toolchain.toml` selects `stable`, not the MSRV, and every CI job builds `stable` too. So a routine dependency bump can silently raise the real floor while the declared one stays put, and the manifest quietly becomes fiction. With the declared floor now accurate, cargo enforces it — `cargo +1.86` fails with `bugsee-cli@0.7.4 requires rustc 1.88` instead of building a binary that claims to support a toolchain it cannot. CLAUDE.md said "MSRV 1.79 (pinned via `rust-toolchain.toml`)", which was wrong twice over: the version, and the claim that rust-toolchain.toml pins it. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --- CLAUDE.md | 7 +++++-- Cargo.toml | 5 ++++- 2 files changed, 9 insertions(+), 3 deletions(-) diff --git a/CLAUDE.md b/CLAUDE.md index 2769b00..4a3dcfb 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -14,8 +14,11 @@ per-build-system orchestrators shell to it instead of each re-implementing the HTTP / compression / retry / presigned-handshake logic — the Android Gradle plugin (Kotlin), and the iOS SDK + fastlane `BugseeAgent`s (Python). -Binary crate, no library target. Edition 2021, MSRV 1.79 (pinned via -`rust-toolchain.toml`). +Binary crate, no library target. Edition 2021, MSRV 1.88 (declared in +`Cargo.toml`'s `rust-version`). `rust-toolchain.toml` selects `stable`, NOT the +MSRV — and CI builds `stable` too, so nothing in CI catches MSRV drift. A +dependency bump can silently raise the real floor; check with `cargo + +check --all-targets` and update `rust-version` in the same change. ## Commands diff --git a/Cargo.toml b/Cargo.toml index b290ed2..0ad4311 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -2,7 +2,10 @@ name = "bugsee-cli" version = "0.7.4" edition = "2021" -rust-version = "1.79" +# Real floor, not an aspiration: the locked tree requires 1.88 (`gimli`, +# `globset`, `plist`, `time`). Verify a bump with `cargo + check +# --all-targets` — CI builds `stable`, so it will NOT catch MSRV drift. +rust-version = "1.88" authors = ["Bugsee"] description = "Bugsee CLI — cross-platform symbol collection, conversion, and upload." readme = "README.md"