Skip to content

⬆️ Update GitHub Actions to latest versions#187

Draft
frack113 wants to merge 8 commits into
mainfrom
yaml
Draft

⬆️ Update GitHub Actions to latest versions#187
frack113 wants to merge 8 commits into
mainfrom
yaml

Conversation

@frack113

@frack113 frack113 commented Jun 21, 2026

Copy link
Copy Markdown
Owner

Summary

Update GitHub Actions to latest versions across all CI/CD workflows.

Changes

  • ⬆️ Bumps:
    • Swatinem/rust-cache → v2.9.1
    • taiki/e/install-action → v2.82.1 (migrated to tool: syntax)
    • DavidAnson/markdownlint-cli2-action → v23.2.0
    • EmbarkStudios/cargo-deny-action → v2.0.20
  • 🔧 Config: Replace yamllint max=120 with allow-non-breakable-words

@AntwortEinesLebens

Copy link
Copy Markdown
Collaborator

Honestly, I don't know how to think about this one. This is not a bad idea but the keeping it up to date is kind of a hell. Normally, we only need to secure the release pipeline. Using hash is almost the same as using the exact semver (v0.1.2 for example). It's also useful to use hash when a fix is here but yet release.

We should dive deeper for the pros and cons of this changes, I don't think it's a bad idea but we need more insight from other point of view for this one.

@frack113
frack113 force-pushed the yaml branch 3 times, most recently from d7387b4 to d7b5bd2 Compare June 25, 2026 04:51
@frack113 frack113 changed the title 🔒 Harden CI/CD workflows with SHA-pinned actions and dependency bumps ⬆️ Update GitHub Actions to latest versions Jun 25, 2026
@frack113
frack113 marked this pull request as draft June 25, 2026 14:14
@frack113
frack113 marked this pull request as ready for review June 26, 2026 04:50
Comment thread .github/workflows/build.yaml Outdated
Comment thread .yamllint.yaml
frack113 added 3 commits June 29, 2026 19:20
Targetting stable counter the security argument. Stable is not a
fixed version tag but keeps updating. This is what you want to
avoid for supply chain attacks.
The allow-non-breakable-words rule now covers long URLs,
making this manual exception unnecessary.
@frack113

frack113 commented Jul 4, 2026

Copy link
Copy Markdown
Owner Author

@AntwortEinesLebens thanks for the review. I addressed both of your points in recent commits:

  1. dtolnay/rust-toolchain — changed back to pinning a commit hash (4be9e76fd7c4901c61fb841f559994984270fce7) instead of stable, so supply chain safety is preserved. See commit 7ff12a7.

  2. .yamllint.yaml — added allow-non-breakable-words and allow-non-breakable-inline-mappings as you suggested, and removed the obsolete # yamllint disable-line exception in lint.yaml (commit c34eb9f). The rules are sensible for CI/CD files with long URLs, SHAs, and action references.

Could you take another look when you get a chance?

@AntwortEinesLebens AntwortEinesLebens left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

One last change and this is ready to go

Comment thread .yamllint.yaml Outdated
@frack113

frack113 commented Jul 5, 2026

Copy link
Copy Markdown
Owner Author

✅ Fixed: removed max: 120 and wrapped the two lines exceeding 80 chars (SPDX comment in lint.yaml and # stable comment in build.yaml). yamllint passes now.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants