ci(deps): pin cargo-release to v0.1.0 - #11220
Merged
Merged
Conversation
Move all four ZcashFoundation/cargo-release call sites from 34a37595755444456ce0e2d2b1258d9a29c14fac to 0083006dfd267ed560b4cf1aed347ef2f326162e, the first tagged release of that action (v0.1.0). The new pin includes its supply-chain hardening: install lifecycle scripts are refused during `npm install`, the dependency audit runs as its own CI job so it cannot mask a stale bundle, and the bundled undici carries the fix for GHSA-8xcm-r25x-g524, GHSA-m8rv-5g2x-5cg5 and GHSA-v3r7-h72x-cjcm. This is behaviourally inert. `src/` and `action.yml` are byte-identical between the two commits, so the release logic does not change; the only runtime delta in dist/index.js across the range is undici 6.27.0 -> 6.28.0. Safe to land ahead of the open v7.0.0 release PR. Also adds the trailing version comment. These four lines were the only SHA pins in the workflows without one, because until now the action had no release to reference. The comment matches each file's existing style and lets Dependabot track the action from here on. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
alchemydc
added
A-dependencies
|
Warning No auditable source files found in this PR's diff. |
Contributor
There was a problem hiding this comment.
Pull request overview
Pins all cargo-release workflow call sites to tagged release v0.1.0 without changing release behavior.
Changes:
- Updates four action pins to commit
0083006. - Adds version comments for dependency tracking.
- Process gap: no pre-discussed issue is linked.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
.github/workflows/pr-gate.yml |
Updates the release-check action pin. |
.github/workflows/release.yml |
Updates check, publish, and finalize action pins. |
conradoplg
approved these changes
Aug 7, 2026
Collaborator
I don't think this is blocking, but for reference I don't think this is true. That check only runs in release PRs. |
Contributor
Merge Queue Status
This pull request spent 46 seconds in the queue, including 9 seconds running CI. Required conditions to merge
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Moves all four
ZcashFoundation/cargo-releasecall sites to the action's first tagged release, v0.1.0 (0083006dfd267ed560b4cf1aed347ef2f326162e), from34a37595755444456ce0e2d2b1258d9a29c14fac.What the new pin brings
The previous pin predates that repo's supply-chain hardening. v0.1.0 includes:
ignore-scripts=true, so dependency install lifecycle hooks are refused duringnpm install— the execution path a ChainDrop-class worm uses.npm auditsplit into its own CI job, so a newly published advisory can no longer short-circuit the bundle drift check (it previously masked a staledist/for ~12 hours).This is behaviourally inert
src/andaction.ymlare byte-identical between the two commits, so none of the release logic, inputs, or outputs change. Across the whole 8-commit range the only runtime delta indist/index.jsis the undici bump; everything else was CI config, docs, or dev dependencies.That is why this is safe to land ahead of the open v7.0.0 release PR (#11219) rather than after it — v7.0.0 then publishes using the hardened, attested bundle, with no change to how the release behaves.
Call sites
pr-gate.ymlcheckrelease.ymlcheckrelease.ymlpublishrelease.ymlfinalizeAlso adds the version comment
These four lines were the only SHA pins in the workflows lacking a trailing
# vX.Y.Zcomment (200 of 204 carry one) — because until now the action had no release to reference. Each file's existing style is matched (# vinpr-gate.yml,#vinrelease.yml). The comment is also what lets Dependabot track this action going forward; with no tags published it previously had nothing to compare against.Verification
v0.1.0and is fetchable on the remote as bothrefs/heads/mainandrefs/tags/v0.1.0^{}.gh attestation verify dist/index.js --repo ZcashFoundation/cargo-releasepasses, signed by.github/workflows/attest.yml(SLSA buildType v1).pr-gate.yml's "Check desired release state" step is one of the four call sites andpr-gate-resultis a required check, so a green run means the new pin actually executed in Zebra CI.🤖 Generated with Claude Code