Skip to content

ops: Resolve ref-version-mismatch, stale-action-refs, superfluous-actions, and unpinned-uses - #73

Open
hashcatHitman wants to merge 2 commits into
rust-lang:mainfrom
hashcatHitman:ref-version-mismatch_and_stale-action-refs_and_superfluous-actions_and_unpinned-uses
Open

hashcatHitman wants to merge 2 commits into
rust-lang:mainfrom
hashcatHitman:ref-version-mismatch_and_stale-action-refs_and_superfluous-actions_and_unpinned-uses

Conversation

@hashcatHitman

Copy link
Copy Markdown
Member

In pursuit of getting more zizmor lints enforced across rust-lang repos through crabwatch, this PR fixes all findings of the ref-version-mismatch, stale-action-refs, superfluous-actions, and unpinned-uses rules (there were no findings for unpinned-uses in this repo, though).

For Swatinem/rust-cache, it seems 2.9.1 may have been re-tagged at some point. You can compare the old commit and the new commit here: https://github.com/Swatinem/rust-cache/compare/e18b497796c12c097a38f9edb9d0641fb99eee32..c19371144df3bb44fab255c43d04cbc2ab54d1c4

The only difference is changelog entries being added/removed.

For dtolnay/rust-toolchain, it seems like re-tagging is the only tagging it knows. Fortunately, rustup is already installed on ubuntu-latest, windows-latest, and macos-latest. Switching to using rustup directly clears ref-version-mismatch and stale-action-refs, with the added benefit of clearing superfluous-actions.

The hash pin format is supported by tools like Dependabot and Renovate, which can update the pinned hashes and their associated comments. See also: #67

See: https://github.com/Swatinem/rust-cache/releases/tag/v2.9.1

See: https://github.com/Swatinem/rust-cache/compare/e18b497796c12c097a38f9edb9d0641fb99eee32..c19371144df3bb44fab255c43d04cbc2ab54d1c4

The only difference is the official release seems to have forgotten to
update the changelog.

Signed-off-by: hashcatHitman <155700084+hashcatHitman@users.noreply.github.com>
Signed-off-by: hashcatHitman <155700084+hashcatHitman@users.noreply.github.com>

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: zizmor PR opened

Development

Successfully merging this pull request may close these issues.

1 participant