From a49d7e5d6e315920230b318554d27d0a49899ae7 Mon Sep 17 00:00:00 2001 From: ShaharNaveh <50263213+ShaharNaveh@users.noreply.github.com> Date: Mon, 30 Mar 2026 18:48:55 +0200 Subject: [PATCH 01/11] Use `rustup` --- .github/workflows/ci.yaml | 35 +++++++++++------------------------ 1 file changed, 11 insertions(+), 24 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 3f5207a12c8..7fb9b191213 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -47,10 +47,10 @@ jobs: with: persist-credentials: false - - uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 - with: - components: clippy - toolchain: stable + - run: rustup toolchain install stable + + - name: Install clippy + run: rustup component add clippy --toolchain=stable - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 with: @@ -248,9 +248,7 @@ jobs: with: persist-credentials: false - - uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 - with: - toolchain: stable + - run: rustup toolchain install stable - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 with: @@ -363,10 +361,7 @@ jobs: with: python-version: ${{ env.PYTHON_VERSION }} - - uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 - with: - toolchain: stable - components: rustfmt + run: rustup component add rustfmt --toolchain=stable - uses: cargo-bins/cargo-binstall@113a77a4ce971c41332f2129c3d995df993cf746 # v1.17.8 @@ -416,16 +411,13 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 30 env: - NIGHTLY_CHANNEL: nightly + RUSTUP_TOOLCHAIN: nightly steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false - - uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 - with: - toolchain: ${{ env.NIGHTLY_CHANNEL }} - components: miri + - run: rustup component add miri - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 with: @@ -448,10 +440,8 @@ jobs: with: persist-credentials: false - - uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 - with: - components: clippy - toolchain: stable + - name: Install clippy + run: rustup component add clippy --toolchain=stable - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 with: @@ -526,10 +516,7 @@ jobs: with: persist-credentials: false - - uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 - with: - target: wasm32-wasip1 - toolchain: stable + - run: rustup toolchain install stable --target wasm32-wasip1 - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 with: From 211f6e71ca090adb3026d2344820e6bb166f285d Mon Sep 17 00:00:00 2001 From: ShaharNaveh <50263213+ShaharNaveh@users.noreply.github.com> Date: Mon, 30 Mar 2026 18:59:46 +0200 Subject: [PATCH 02/11] fix --- .github/workflows/ci.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 7fb9b191213..ff9eef442d4 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -361,7 +361,7 @@ jobs: with: python-version: ${{ env.PYTHON_VERSION }} - run: rustup component add rustfmt --toolchain=stable + - run: rustup component add rustfmt --toolchain=stable - uses: cargo-bins/cargo-binstall@113a77a4ce971c41332f2129c3d995df993cf746 # v1.17.8 From b6bc9c5fc410628fbfe42f96583c0ca66b806ce3 Mon Sep 17 00:00:00 2001 From: ShaharNaveh <50263213+ShaharNaveh@users.noreply.github.com> Date: Tue, 31 Mar 2026 09:44:35 +0200 Subject: [PATCH 03/11] Fix miri --- .github/workflows/ci.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index ff9eef442d4..7aa8c5820f2 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -417,7 +417,7 @@ jobs: with: persist-credentials: false - - run: rustup component add miri + - run: rustup component add miri --toolchain="${{ env.RUSTUP_TOOLCHAIN }}" - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 with: From 9d71f4005f0e020697d6894c4469ee4788e8345b Mon Sep 17 00:00:00 2001 From: ShaharNaveh <50263213+ShaharNaveh@users.noreply.github.com> Date: Tue, 31 Mar 2026 10:05:10 +0200 Subject: [PATCH 04/11] Revert `rustup` changes --- .github/workflows/ci.yaml | 35 ++++++++++++++++++++++++----------- 1 file changed, 24 insertions(+), 11 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 88bf5968654..99906707cf3 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -50,10 +50,10 @@ jobs: with: persist-credentials: false - - run: rustup toolchain install stable - - - name: Install clippy - run: rustup component add clippy --toolchain=stable + - uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 + with: + components: clippy + toolchain: stable - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 with: @@ -251,7 +251,9 @@ jobs: with: persist-credentials: false - - run: rustup toolchain install stable + - uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 + with: + toolchain: stable - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 with: @@ -364,7 +366,10 @@ jobs: with: python-version: ${{ env.PYTHON_VERSION }} - - run: rustup component add rustfmt --toolchain=stable + - uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 + with: + toolchain: stable + components: rustfmt - uses: cargo-bins/cargo-binstall@113a77a4ce971c41332f2129c3d995df993cf746 # v1.17.8 @@ -414,13 +419,16 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 30 env: - RUSTUP_TOOLCHAIN: nightly + NIGHTLY_CHANNEL: nightly steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false - - run: rustup component add miri --toolchain="${{ env.RUSTUP_TOOLCHAIN }}" + - uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 + with: + toolchain: ${{ env.NIGHTLY_CHANNEL }} + components: miri - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 with: @@ -443,8 +451,10 @@ jobs: with: persist-credentials: false - - name: Install clippy - run: rustup component add clippy --toolchain=stable + - uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 + with: + components: clippy + toolchain: stable - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 with: @@ -519,7 +529,10 @@ jobs: with: persist-credentials: false - - run: rustup toolchain install stable --target wasm32-wasip1 + - uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 + with: + target: wasm32-wasip1 + toolchain: stable - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 with: From ff15350db9ea6b294398027f83254a92ae288edf Mon Sep 17 00:00:00 2001 From: ShaharNaveh <50263213+ShaharNaveh@users.noreply.github.com> Date: Tue, 31 Mar 2026 10:06:59 +0200 Subject: [PATCH 05/11] Use `dtolnay/rust-toolchain` instead of `rustup` --- .github/workflows/ci.yaml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 99906707cf3..193c793aff4 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -170,7 +170,10 @@ jobs: restore-keys: | cargo-check-${{ runner.os }}-${{ matrix.target }}- - - run: rustup toolchain install stable --target "${{ matrix.target }}" + - uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 + with: + toolchain: stable + target: ${{ matrix.target }} - name: Setup Android NDK if: ${{ matrix.target == 'aarch64-linux-android' }} From 15178ce3a46b79ffa4c55ca5270a0b9192fff8ba Mon Sep 17 00:00:00 2001 From: ShaharNaveh <50263213+ShaharNaveh@users.noreply.github.com> Date: Tue, 31 Mar 2026 10:11:09 +0200 Subject: [PATCH 06/11] Add zizmor conf --- .github/zizmor.yml | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) create mode 100644 .github/zizmor.yml diff --git a/.github/zizmor.yml b/.github/zizmor.yml new file mode 100644 index 00000000000..a068061ca4e --- /dev/null +++ b/.github/zizmor.yml @@ -0,0 +1,16 @@ +rules: + unpinned-uses: + config: + policies: + # dtolnay/rust-toolchain is a trusted action that uses lightweight branch + # refs (@stable, @nightly, etc.) by design. Pinning to a hash would break + # the intended usage pattern. + # + # We can remove this once https://github.com/dtolnay/rust-toolchain/issues/180 is resolved + dtolnay/rust-toolchain: any + # dtolnay/rust-toolchain handles component installation, target addition, and + # override configuration beyond what a bare `rustup` invocation provides. + # + # See: https://github.com/zizmorcore/zizmor/issues/1817 + superfluous-actions: + disable: true From e843ddc9ab26434c55add1842ec2ece9138d912f Mon Sep 17 00:00:00 2001 From: ShaharNaveh <50263213+ShaharNaveh@users.noreply.github.com> Date: Tue, 31 Mar 2026 10:14:30 +0200 Subject: [PATCH 07/11] Pin to `@stable` --- .github/workflows/ci.yaml | 21 +++++++-------------- 1 file changed, 7 insertions(+), 14 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 193c793aff4..2b4260a1d3b 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -50,10 +50,9 @@ jobs: with: persist-credentials: false - - uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 + - uses: dtolnay/rust-toolchain@stable with: components: clippy - toolchain: stable - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 with: @@ -170,10 +169,9 @@ jobs: restore-keys: | cargo-check-${{ runner.os }}-${{ matrix.target }}- - - uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 + - uses: dtolnay/rust-toolchain@stable with: toolchain: stable - target: ${{ matrix.target }} - name: Setup Android NDK if: ${{ matrix.target == 'aarch64-linux-android' }} @@ -254,9 +252,7 @@ jobs: with: persist-credentials: false - - uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 - with: - toolchain: stable + - uses: dtolnay/rust-toolchain@stable - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 with: @@ -369,9 +365,8 @@ jobs: with: python-version: ${{ env.PYTHON_VERSION }} - - uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 + - uses: dtolnay/rust-toolchain@stable with: - toolchain: stable components: rustfmt - uses: cargo-bins/cargo-binstall@113a77a4ce971c41332f2129c3d995df993cf746 # v1.17.8 @@ -428,7 +423,7 @@ jobs: with: persist-credentials: false - - uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 + - uses: dtolnay/rust-toolchain@master with: toolchain: ${{ env.NIGHTLY_CHANNEL }} components: miri @@ -454,10 +449,9 @@ jobs: with: persist-credentials: false - - uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 + - uses: dtolnay/rust-toolchain@stable with: components: clippy - toolchain: stable - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 with: @@ -532,10 +526,9 @@ jobs: with: persist-credentials: false - - uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 + - uses: dtolnay/rust-toolchain@stable with: target: wasm32-wasip1 - toolchain: stable - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 with: From 53381ae8048052b376f5cb60b86e12f1bc865a0e Mon Sep 17 00:00:00 2001 From: ShaharNaveh <50263213+ShaharNaveh@users.noreply.github.com> Date: Tue, 31 Mar 2026 10:15:37 +0200 Subject: [PATCH 08/11] Pin to `@stable` in `release.yml` --- .github/workflows/release.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index f06f0d3adc6..ae6c9da9b74 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -52,7 +52,7 @@ jobs: with: persist-credentials: false - - uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 + - uses: dtolnay/rust-toolchain@stable with: target: ${{ matrix.target }} @@ -89,7 +89,7 @@ jobs: with: persist-credentials: false - - uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 + - uses: dtolnay/rust-toolchain@stable with: targets: wasm32-wasip1 From c7d5ec841e2813b1600d80affcb0b306784a1e07 Mon Sep 17 00:00:00 2001 From: ShaharNaveh <50263213+ShaharNaveh@users.noreply.github.com> Date: Tue, 31 Mar 2026 10:16:52 +0200 Subject: [PATCH 09/11] Remove leftover --- .github/workflows/ci.yaml | 2 -- 1 file changed, 2 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 2b4260a1d3b..394ce9496c3 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -170,8 +170,6 @@ jobs: cargo-check-${{ runner.os }}-${{ matrix.target }}- - uses: dtolnay/rust-toolchain@stable - with: - toolchain: stable - name: Setup Android NDK if: ${{ matrix.target == 'aarch64-linux-android' }} From b73541001a5c371d7faef109993a43f0134b47d9 Mon Sep 17 00:00:00 2001 From: ShaharNaveh <50263213+ShaharNaveh@users.noreply.github.com> Date: Tue, 31 Mar 2026 10:21:21 +0200 Subject: [PATCH 10/11] Fix cargo check --- .github/workflows/ci.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 394ce9496c3..d1075152e99 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -170,6 +170,8 @@ jobs: cargo-check-${{ runner.os }}-${{ matrix.target }}- - uses: dtolnay/rust-toolchain@stable + with: + target: ${{ matrix.target }} - name: Setup Android NDK if: ${{ matrix.target == 'aarch64-linux-android' }} From b1ff16ba8e8affc42e2b16c09787e2be7ec643bb Mon Sep 17 00:00:00 2001 From: ShaharNaveh <50263213+ShaharNaveh@users.noreply.github.com> Date: Tue, 31 Mar 2026 10:22:26 +0200 Subject: [PATCH 11/11] Fix conf --- .github/zizmor.yml | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/.github/zizmor.yml b/.github/zizmor.yml index a068061ca4e..f22f76b70d8 100644 --- a/.github/zizmor.yml +++ b/.github/zizmor.yml @@ -5,12 +5,10 @@ rules: # dtolnay/rust-toolchain is a trusted action that uses lightweight branch # refs (@stable, @nightly, etc.) by design. Pinning to a hash would break # the intended usage pattern. - # - # We can remove this once https://github.com/dtolnay/rust-toolchain/issues/180 is resolved + # We can remove this once https://github.com/dtolnay/rust-toolchain/issues/180 is resolved dtolnay/rust-toolchain: any # dtolnay/rust-toolchain handles component installation, target addition, and # override configuration beyond what a bare `rustup` invocation provides. - # # See: https://github.com/zizmorcore/zizmor/issues/1817 superfluous-actions: disable: true