From 9fa8ddcc671a99e75c83c00450c7511184e5ceda Mon Sep 17 00:00:00 2001 From: changyuanl Date: Sun, 23 Aug 2026 09:59:24 -0700 Subject: [PATCH 1/5] ci: pin dtolnay/rust-toolchain to a full-length commit SHA Signed-off-by: Changyuan Lyu --- .github/workflows/release.yml | 4 +++- .github/workflows/rust.yml | 6 ++++-- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 66c0bad5..a3085866 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -19,7 +19,9 @@ jobs: runs-on: ${{ matrix.os }} steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - - uses: dtolnay/rust-toolchain@stable + - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # master + with: + toolchain: stable - name: Build run: RUSTFLAGS='-C target-feature=+crt-static' cargo +stable build --target ${{ matrix.target }} --release - name: Upload artifact diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml index 99579fab..dce696c3 100644 --- a/.github/workflows/rust.yml +++ b/.github/workflows/rust.yml @@ -46,12 +46,14 @@ jobs: target/ key: ${{ matrix.target.name }}-cargo-${{ hashFiles('**/Cargo.lock') }} - name: Install nightly Rust - uses: dtolnay/rust-toolchain@nightly + uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # master with: + toolchain: nightly components: rustfmt,llvm-tools - name: Install stable Rust - uses: dtolnay/rust-toolchain@stable + uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # master with: + toolchain: stable components: clippy - name: Install tools uses: taiki-e/install-action@16b05812d776ae1dfaabc8277e421fb6d2506419 # v2.82.7 From 89bdf6e33d227f36a4701234a967e33ae1de1ed9 Mon Sep 17 00:00:00 2001 From: changyuanl Date: Sun, 23 Aug 2026 10:08:47 -0700 Subject: [PATCH 2/5] ci: replace softprops/action-gh-release with `gh release` Signed-off-by: Changyuan Lyu --- .github/workflows/release.yml | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index a3085866..4e95c8df 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -37,7 +37,7 @@ jobs: needs: [build_alioth, build_bootloader] runs-on: ubuntu-latest permissions: - contents: write + contents: write # Required to create/modify releases steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Get tag message @@ -66,9 +66,12 @@ jobs: -C $PWD/docs macos-signing.md xz alioth-*-*.tar - name: Create Release - uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1 - with: - files: alioth-*-*.tar.xz - fail_on_unmatched_files: true - draft: true - body: ${{ steps.tag_message.outputs.msg }} + env: + GH_TOKEN: '${{ secrets.GITHUB_TOKEN }}' + STEPS_TAG_MESSAGE_OUTPUTS_MSG: ${{ steps.tag_message.outputs.msg }} + run: | + gh release create "${GITHUB_REF_NAME}" \ + --title "Release ${GITHUB_REF_NAME}" \ + --notes "${STEPS_TAG_MESSAGE_OUTPUTS_MSG}" \ + --draft \ + alioth-*-*.tar.xz From 37a58f3be57d976ab040a0cfed515fb79b869a93 Mon Sep 17 00:00:00 2001 From: changyuanl Date: Sun, 23 Aug 2026 10:40:02 -0700 Subject: [PATCH 3/5] ci: remove git credentials after actions/checkout Signed-off-by: Changyuan Lyu --- .github/workflows/bootloader.yml | 2 ++ .github/workflows/release.yml | 4 ++++ .github/workflows/rust.yml | 4 ++++ 3 files changed, 10 insertions(+) diff --git a/.github/workflows/bootloader.yml b/.github/workflows/bootloader.yml index 2b427d36..c4a5c29a 100644 --- a/.github/workflows/bootloader.yml +++ b/.github/workflows/bootloader.yml @@ -23,6 +23,8 @@ jobs: runs-on: ${{ matrix.os }} steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 with: go-version: stable diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 4e95c8df..4b42817b 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -19,6 +19,8 @@ jobs: runs-on: ${{ matrix.os }} steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # master with: toolchain: stable @@ -40,6 +42,8 @@ jobs: contents: write # Required to create/modify releases steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false - name: Get tag message id: tag_message run: | diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml index dce696c3..274f438b 100644 --- a/.github/workflows/rust.yml +++ b/.github/workflows/rust.yml @@ -36,6 +36,8 @@ jobs: steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: | @@ -87,6 +89,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false - name: Download coverage reports uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: From e1144d9dbdf83e26890743a938a2b715ae8e8803 Mon Sep 17 00:00:00 2001 From: changyuanl Date: Sun, 23 Aug 2026 10:08:47 -0700 Subject: [PATCH 4/5] ci: restrict workflow level permissions Signed-off-by: Changyuan Lyu --- .github/workflows/bootloader.yml | 3 +++ .github/workflows/release.yml | 3 +++ .github/workflows/rust.yml | 3 ++- 3 files changed, 8 insertions(+), 1 deletion(-) diff --git a/.github/workflows/bootloader.yml b/.github/workflows/bootloader.yml index c4a5c29a..0c48964d 100644 --- a/.github/workflows/bootloader.yml +++ b/.github/workflows/bootloader.yml @@ -1,5 +1,8 @@ name: Build Bootloader +permissions: + contents: read + on: workflow_dispatch: workflow_call: diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 4b42817b..afccbb01 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,5 +1,8 @@ name: Release +permissions: + contents: read + on: push: tags: diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml index 274f438b..f27bd43d 100644 --- a/.github/workflows/rust.yml +++ b/.github/workflows/rust.yml @@ -1,6 +1,7 @@ name: Rust -permissions: read-all +permissions: + contents: read on: push: From c963111cbcbaeec3589bc645adf228355a0f4ab9 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 1 Aug 2026 12:12:58 +0000 Subject: [PATCH 5/5] ci: Bump the actions group with 4 updates Bumps the actions group with 4 updates: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `7.0.0` | `7.0.1` | | [actions/setup-go](https://github.com/actions/setup-go) | `6.5.0` | `7.0.0` | | [taiki-e/install-action](https://github.com/taiki-e/install-action) | `2.82.7` | `2.85.4` | | [coverallsapp/github-action](https://github.com/coverallsapp/github-action) | `2.3.7` | `2.3.8` | Updates `actions/checkout` from 7.0.0 to 7.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0...3d3c42e5aac5ba805825da76410c181273ba90b1) Updates `actions/setup-go` from 6.5.0 to 7.0.0 - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](https://github.com/actions/setup-go/compare/924ae3a1cded613372ab5595356fb5720e22ba16...b7ad1dad31e06c5925ef5d2fc7ad053ef454303e) Updates `taiki-e/install-action` from 2.82.7 to 2.85.4 - [Release notes](https://github.com/taiki-e/install-action/releases) - [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/taiki-e/install-action/compare/16b05812d776ae1dfaabc8277e421fb6d2506419...065d6a08a14e61e89fb0a4c10eecdbdef39c7d8e) Updates `coverallsapp/github-action` from 2.3.7 to 2.3.8 - [Release notes](https://github.com/coverallsapp/github-action/releases) - [Commits](https://github.com/coverallsapp/github-action/compare/5cbfd81b66ca5d10c19b062c04de0199c215fb6e...8d6379e14d29928660c4ba802d8e85393440b329) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: actions/setup-go dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: taiki-e/install-action dependency-version: 2.85.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: coverallsapp/github-action dependency-version: 2.3.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions ... Signed-off-by: dependabot[bot] Signed-off-by: Changyuan Lyu --- .github/workflows/bootloader.yml | 4 ++-- .github/workflows/release.yml | 4 ++-- .github/workflows/rust.yml | 8 ++++---- 3 files changed, 8 insertions(+), 8 deletions(-) diff --git a/.github/workflows/bootloader.yml b/.github/workflows/bootloader.yml index 0c48964d..bea5ee60 100644 --- a/.github/workflows/bootloader.yml +++ b/.github/workflows/bootloader.yml @@ -25,10 +25,10 @@ jobs: arch: aarch64 runs-on: ${{ matrix.os }} steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: stable cache-dependency-path: "**/go.sum" diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index afccbb01..0e0c7209 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -21,7 +21,7 @@ jobs: os: macos-latest runs-on: ${{ matrix.os }} steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # master @@ -44,7 +44,7 @@ jobs: permissions: contents: write # Required to create/modify releases steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Get tag message diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml index f27bd43d..04cb5ec4 100644 --- a/.github/workflows/rust.yml +++ b/.github/workflows/rust.yml @@ -36,7 +36,7 @@ jobs: runs-on: ${{ matrix.target.os }} steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 @@ -59,7 +59,7 @@ jobs: toolchain: stable components: clippy - name: Install tools - uses: taiki-e/install-action@16b05812d776ae1dfaabc8277e421fb6d2506419 # v2.82.7 + uses: taiki-e/install-action@065d6a08a14e61e89fb0a4c10eecdbdef39c7d8e # v2.85.4 with: tool: cargo-llvm-cov,cargo-deny - name: Check dependencies @@ -89,7 +89,7 @@ jobs: needs: build_test runs-on: ubuntu-latest steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Download coverage reports @@ -103,5 +103,5 @@ jobs: sed -i 's#SF:/Users/#SF:/home/#g' lcov/*apple-darwin*.info npx lcov-result-merger 'lcov/lcov-*.info' lcov.info - name: Upload coverage - uses: coverallsapp/github-action@5cbfd81b66ca5d10c19b062c04de0199c215fb6e # v2.3.7 + uses: coverallsapp/github-action@8d6379e14d29928660c4ba802d8e85393440b329 # v2.3.8 continue-on-error: true