Update setup-rust dependencies for Node.js 24 - #396
Open
lodyai[bot] wants to merge 4 commits into
Open
Conversation
Pin every Node-based dependency in `setup-rust` to a verified Node.js 24 release and guard the revisions with manifest tests.
Contributor
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
Summary
WalkthroughUpdate the ChangesSetup Rust Node 24 migration
Possibly related issues
Possibly related PRs
Suggested reviewers: Poem
Caution Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional.
❌ Failed checks (1 error)
✅ Passed checks (19 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
Contributor
Reviewer's GuideThis PR updates the setup-rust composite GitHub Action to use pinned Node.js 24-compatible revisions of its Node-based dependencies (actions/cache, mozilla-actions/sccache-action, and msys2/setup-msys2), and adds a regression test to ensure those exact revisions remain pinned, while documenting the change in the changelog and README. Flow diagram for setup-rust manifest regression test on pinned revisionsflowchart TD
test_manifest["test_setup_rust_manifest.py"] --> read_manifest["Read setup-rust/action.yml"]
read_manifest --> check_cache_revision["Check actions/cache commit SHA matches Node.js 24 pin"]
check_cache_revision --> check_sccache_revision["Check sccache-action commit SHA matches Node.js 24 pin"]
check_sccache_revision --> check_msys2_revision["Check setup-msys2 commit SHA matches Node.js 24 pin"]
check_msys2_revision --> test_pass["Tests pass if all revisions are exactly pinned"]
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![codescene-access[bot]](https://avatars.githubusercontent.com/in/3755875?s=60&v=4){kind=small}
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
leynos
marked this pull request as ready for review
August 3, 2026 10:14
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/actions/setup-rust/README.md:
- Line 135: Update the revised-action paragraph in the setup-rust README to
document all pins changed in action.yml: retain the
mozilla-actions/sccache-action revision and add
actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 and
msys2/setup-msys2@66cd2cce69caa17b53920067426061ca1de3a884, keeping the
documentation aligned with the manifest.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 575ce551-bf16-4f41-bd91-a20bca443781
📒 Files selected for processing (4)
.github/actions/setup-rust/CHANGELOG.md.github/actions/setup-rust/README.md.github/actions/setup-rust/action.yml.github/actions/setup-rust/tests/test_setup_rust_manifest.py
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
leynos/polythene(auto-detected)
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
List every Node.js-backed action revision changed by the setup-rust update so the README remains aligned with the composite action manifest.
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
This comment was marked as resolved.
This comment was marked as resolved.
Document how maintainers verify and synchronize the Node.js 24 action pins. Exercise the local `setup-rust` composite action with `act` and prove that `rustc` and `cargo` remain available to downstream steps.
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
Owner
|
@coderabbitai resume |
Contributor
✅ Action performedReviews resumed. |
Contributor
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
echo '--- PR metadata, body, and checks ---'
gh pr view 396 --repo leynos/shared-actions \
--json number,state,title,url,body,headRefName,baseRefName \
--jq '{number,state,title,url,headRefName,baseRefName,body}'
gh pr checks 396 --repo leynos/shared-actions || true
echo '--- Changed files ---'
gh pr diff 396 --repo leynos/shared-actions --name-only
echo '--- Linked issue `#81` ---'
gh issue view 81 --repo leynos/shared-actions \
--json number,state,title,url,body \
--jq '{number,state,title,url,body}'
echo '--- Relevant source map ---'
fd -HI -t f '^(action\.ya?ml|developers-guide\.md|test_.*\.py|.*\.ya?ml)$' \
.github docs 2>/dev/null | sed -n '1,240p'
echo '--- Documentation and manifest-test evidence ---'
rg -n -i -C 4 \
'(NODE24_ACTION_REVISIONS|Node\.js 24|full commit SHA|setup-rust.*maint|action-pin|act-backed|runner-backed)' \
docs .github/actions/setup-rust .github/workflows 2>/dev/null || true
echo '--- setup-rust cache, sccache, and diagnostics evidence ---'
rg -n -i -C 3 \
'(cache-hit|cache.*(hit|miss)|sccache.*(hit|miss|stat)|failure categor|runner OS|setup-rust)' \
.github/actions/setup-rust .github/workflows 2>/dev/null || true
echo '--- Existing observability issues ---'
gh issue list --repo leynos/shared-actions --state all --limit 100 \
--search '"cache" "sccache" "diagnostic"' \
--json number,state,title,url \
--jq '.[] | "\(.number)\t\(.state)\t\(.title)\t\(.url)"'Length of output: 45325 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo '--- Workflow: local setup-rust and downstream validation ---'
sed -n '96,145p' .github/workflows/test-rustflags-export.yml
echo '--- Act-backed workflow test map and relevant assertions ---'
ast-grep outline tests/workflows/test_rustflags_export_workflow.py --items all --view expanded
rg -n -C 8 \
'(setup-rust-toolchain-available|setup-rust-toolchain|rustc --version|cargo --version|ACT_WORKFLOW_TESTS|act)' \
tests/workflows/test_rustflags_export_workflow.py
echo '--- PR diff for runner workflow and test ---'
gh pr diff 396 --repo leynos/shared-actions -- \
.github/workflows/test-rustflags-export.yml \
tests/workflows/test_rustflags_export_workflow.pyLength of output: 820 🏁 Script executed: #!/bin/bash
set -euo pipefail
gh api --paginate \
'repos/leynos/shared-actions/pulls/396/files?per_page=100' \
--jq '.[] | select(.filename == ".github/workflows/test-rustflags-export.yml" or .filename == "tests/workflows/test_rustflags_export_workflow.py") | "### \(.filename)\n\(.patch // "PATCH_UNAVAILABLE")\n"'Length of output: 4348
All current CI checks pass. Passing CI does not remove the remaining title ambiguity or replace the required observability tracking. Use this AI agent prompt for the remaining work: You are interacting with an AI system. |
Contributor
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/actions/setup-rust/tests/test_setup_rust_manifest.py:
- Around line 214-223: Update the assertion in
test_node_actions_use_pinned_node24_revisions to include a failure message
containing both step_name and expected_revision, while preserving the existing
comparison.
In @.github/workflows/test-rustflags-export.yml:
- Around line 107-122: Isolate the Rust toolchain contract test by invalidating
or removing any preinstalled Rust tools before the setup-rust action, then
verify that the required toolchain was selected after setup rather than merely
checking generic rustc and cargo availability. In
.github/workflows/test-rustflags-export.yml lines 107-122, update the setup and
verification steps accordingly; in
tests/workflows/test_rustflags_export_workflow.py lines 151-159, assert output
evidence of the selected required toolchain, with no direct change needed
elsewhere.
In `@tests/workflows/test_rustflags_export_workflow.py`:
- Around line 54-76: Strengthen the workflow parsing test around WORKFLOW_PATH
by validating the loaded document, jobs mapping, selected
setup-rust-toolchain-available job, steps collection, and each step mapping
before indexing, removing the dict[str, typ.Any] cast. Replace both bare next
calls with diagnostic assertions, and add informative messages to all six
assertions in the shown validation block. Run a type check that includes
tests/workflows because make typecheck excludes this file.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 51082a73-6d25-4e20-b9de-147935158ee3
📒 Files selected for processing (7)
.github/actions/setup-rust/CHANGELOG.md.github/actions/setup-rust/README.md.github/actions/setup-rust/action.yml.github/actions/setup-rust/tests/test_setup_rust_manifest.py.github/workflows/test-rustflags-export.ymldocs/developers-guide.mdtests/workflows/test_rustflags_export_workflow.py
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
leynos/polythene(auto-detected)
leynos
changed the title
Remove the preinstalled stable toolchain before exercising the composite action and prove that setup selects stable for downstream Rust commands. Harden workflow-shape diagnostics and document the user-visible Node.js 24 dependency update.
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@tests/workflows/test_rustflags_export_workflow.py`:
- Around line 69-98: Extend the workflow structure test around the existing
setup_steps and verify_steps assertions to locate exactly one “Remove the
preinstalled stable toolchain” step before “Setup stable Rust”. Assert its run
script uninstalls the stable toolchain and verifies that “rustup run stable
rustc” fails, ensuring the local setup-rust action is tested without relying on
a runner-provided stable toolchain.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: dd27e2ab-f28b-4a5a-b55c-207f9e2f5770
📒 Files selected for processing (4)
.github/actions/setup-rust/tests/test_setup_rust_manifest.py.github/workflows/test-rustflags-export.ymldocs/users-guide.mdtests/workflows/test_rustflags_export_workflow.py
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
leynos/polythene(auto-detected)
Comment on lines
+69
to
+98
| setup_steps = [step for step in steps if step.get("name") == "Setup stable Rust"] | ||
| assert len(setup_steps) == 1, "expected exactly one Setup stable Rust step" | ||
| setup_step = setup_steps[0] | ||
| assert setup_step["uses"] == "./.github/actions/setup-rust", ( | ||
| "Setup stable Rust must call the local setup-rust action" | ||
| ) | ||
| assert setup_step["with"] == { | ||
| "toolchain": "stable", | ||
| "install-binstall": "false", | ||
| "use-sccache": "false", | ||
| }, "Setup stable Rust must select the isolated stable toolchain path" | ||
|
|
||
| verify_steps = [ | ||
| step | ||
| for step in steps | ||
| if step.get("name") == "Verify Rust tools remain available" | ||
| ] | ||
| assert len(verify_steps) == 1, ( | ||
| "expected exactly one Verify Rust tools remain available step" | ||
| ) | ||
| verify_step = verify_steps[0] | ||
| script = verify_step["run"] | ||
| assert "rustc --version" in script, "verification must execute rustc" | ||
| assert "cargo --version" in script, "verification must execute cargo" | ||
| assert 'test -n "${rustc_version}"' in script, ( | ||
| "verification must assert that rustc returned a version" | ||
| ) | ||
| assert 'test -n "${cargo_version}"' in script, ( | ||
| "verification must assert that cargo returned a version" | ||
| ) |
Contributor
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Assert the stable-toolchain removal precondition.
Add a structural assertion for the Remove the preinstalled stable toolchain step. Require its script to uninstall stable and verify that rustup run stable rustc fails before local setup-rust runs.
Without this assertion, a later removal of the isolation step can make the Act test pass from a runner-provided stable toolchain.
Proposed fix
+ removal_steps = [
+ step
+ for step in steps
+ if step.get("name") == "Remove the preinstalled stable toolchain"
+ ]
+ assert len(removal_steps) == 1, "expected exactly one stable removal step"
+ removal_script = removal_steps[0].get("run")
+ assert isinstance(removal_script, str), "stable removal step must have a script"
+ assert "rustup toolchain uninstall stable" in removal_script, (
+ "stable removal step must uninstall the stable toolchain"
+ )
+ assert "rustup run stable rustc" in removal_script, (
+ "stable removal step must verify stable is unavailable"
+ )
+
setup_steps = [step for step in steps if step.get("name") == "Setup stable Rust"]🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@tests/workflows/test_rustflags_export_workflow.py` around lines 69 - 98,
Extend the workflow structure test around the existing setup_steps and
verify_steps assertions to locate exactly one “Remove the preinstalled stable
toolchain” step before “Setup stable Rust”. Assert its run script uninstalls the
stable toolchain and verifies that “rustup run stable rustc” fails, ensuring the
local setup-rust action is tested without relying on a runner-provided stable
toolchain.
Collaborator
|
@coderabbitai review |
Contributor
✅ Action performedReview finished.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This branch updates every Node-based dependency in
setup-rustto a verified, full-length commit SHA whose action metadata declares the Node.js 24 runtime. It preserves the action interface and cache configuration while removing GitHub Actions Node.js 20 deprecation warnings.External tracking issue: agent-template-rust #81.
The consumer revision update remains release-dependent: consumer repositories should replace
19a7f5d1b8d5c1b2236c39720a5744492b3fc129after this shared-action change is released.Review walkthrough
rustcandcargocoverage.Dependency revisions
actions/cache:0057852bfaa89a56745cba8c7296529d2fc39830(v4.3.0, Node.js 20) to55cc8345863c7cc4c66a329aec7e433d2d1c52a9(v6.1.0, Node.js 24).mozilla-actions/sccache-action:7d986dd989559c6ecdb630a3fd2557667be217ad(v0.0.9, Node.js 20) tofc920bf0ec8de6ee65d409111f7ec508035751ba(v0.0.11, Node.js 24).msys2/setup-msys2:4f806de0a5a7294ffabaff804b38a9b435a73bda(v2.30.0, Node.js 20) to66cd2cce69caa17b53920067426061ca1de3a884(v2.32.0, Node.js 24).Validation
make check-fmt: passed; 217 files were already formatted.make test: passed; 1,062 tests passed, 14 skipped and four snapshots passed.make typecheck: passed.make lint: passed, including shared-action validation.make markdownlint: passed with zero errors.make nixie: passed; all diagrams validated../.venv/bin/ty check --extra-search-path . tests/workflows: passed.actstable-toolchain contract: passed; one test passed and five were deselected.coderabbit review --agent: completed with zero findings.References
Summary by Sourcery
Update the setup-rust shared action to use Node.js 24-compatible, commit-pinned revisions for its Node-based GitHub Actions dependencies.
Bug Fixes:
Enhancements:
Documentation: