Skip to content

ci: add strict clippy rules #3

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
calthejuggler wants to merge 9 commits into
base: main
Choose a base branch
from
Open

ci: add strict clippy rules #3

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
391d31d
ci: add strict clippy rules
calthejuggler Mar 16, 2026
c00866a
fix: clippy warnings
calthejuggler Mar 16, 2026
cf5a0a9
fix: resolve CI failures for MSRV and latest clippy
calthejuggler Mar 16, 2026
40d6a93
fix: bump MSRV to 1.83 to match dependency requirements
calthejuggler Mar 16, 2026
e5f3ac9
fix: pin native-tls for macOS MSRV compat, use --locked in CI
calthejuggler Mar 16, 2026
0d5c36c
chore: gitignore Cargo.lock
calthejuggler Mar 16, 2026
76a0139
fix: bump MSRV to 1.85 for security-framework edition 2024 on macOS
calthejuggler Mar 16, 2026
bc457e9
fix: commit Cargo.lock and use --locked in CI for reproducible builds
calthejuggler Mar 16, 2026
8f8d7f4
chore: update GitHub Actions to latest versions
calthejuggler Mar 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
43 changes: 17 additions & 26 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,9 +2,9 @@ name: CI

on:
push:
branches: [main, master]
branches: [main]
pull_request:
branches: [main, master]
branches: [main]

env:
CARGO_TERM_COLOR: always
Expand All @@ -17,45 +17,36 @@ jobs:
fail-fast: false
matrix:
os: [ubuntu-latest, macos-latest, windows-latest]
rust: [stable, 1.70.0]
rust: [stable, "1.85.0"]

steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v6

- name: Install Rust
uses: dtolnay/rust-action@stable
uses: dtolnay/rust-toolchain@master
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot Mar 16, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Verify action refs that are not pinned to 40-char SHAs.
rg -nP '^\s*-\s*uses:\s*[^@]+@(?!(?:[0-9a-fA-F]{40})$).+$' .github/workflows/*.yml

Repository: absmartly/rust-sdk

Length of output: 576

🏁 Script executed:

sed -n '20,35p' .github/workflows/ci.yml

Repository: absmartly/rust-sdk

Length of output: 420

🏁 Script executed:

cat -n .github/workflows/ci.yml

Repository: absmartly/rust-sdk

Length of output: 2017

🏁 Script executed:

# Check if there are any commit SHAs already pinned in the file
rg -nP '@[0-9a-fA-F]{40}' .github/workflows/ci.yml

Repository: absmartly/rust-sdk

Length of output: 44

Pin GitHub Actions to immutable commit SHAs.

Using moving refs (@master, @stable, @v2) allows upstream changes to alter CI behaviour without review and weakens supply-chain guarantees.

Proposed hardening diff 
-      - name: Install Rust
-        uses: dtolnay/rust-toolchain@master
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@<full_commit_sha>

-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@<full_commit_sha>

-      - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@<full_commit_sha>

-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@<full_commit_sha>

-      - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@<full_commit_sha>

-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@<full_commit_sha>

Also applies to: 30-30, 44-44, 48-48, 63-63, 65-65

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/ci.yml at line 26, Replace all GitHub Action moving refs
in .github/workflows/ci.yml (e.g., the uses: dtolnay/rust-toolchain@master line
and the other uses: entries flagged at lines 30, 44, 48, 63, 65) with immutable
commit SHAs; locate each uses: "<owner>/<repo>@<ref>" occurrence that uses
branches or tags like `@master`, `@stable`, or `@v2` and pin them to the corresponding
commit SHA from the action's repository (update the ref to @<full-commit-sha>),
ensuring every uses: entry in the workflow is changed to a specific commit hash
and not a moving ref.

with:
toolchain: ${{ matrix.rust }}

- name: Cache cargo registry
uses: actions/cache@v4
- uses: Swatinem/rust-cache@v2
with:
path: |
~/.cargo/registry
~/.cargo/git
target
key: ${{ runner.os }}-cargo-${{ matrix.rust }}-${{ hashFiles('**/Cargo.lock') }}
restore-keys: |
${{ runner.os }}-cargo-${{ matrix.rust }}-

- name: Build
run: cargo build --verbose
key: ${{ matrix.rust }}

- name: Run tests
run: cargo test --verbose
run: cargo test --locked --verbose

lint:
name: Lint
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v6

- name: Install Rust
uses: dtolnay/rust-action@stable
uses: dtolnay/rust-toolchain@stable
with:
toolchain: stable
components: rustfmt, clippy

- uses: Swatinem/rust-cache@v2

- name: Check formatting
run: cargo fmt --all -- --check

Expand All @@ -66,14 +57,14 @@ jobs:
name: Documentation
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v6

- name: Install Rust
uses: dtolnay/rust-action@stable
with:
toolchain: stable
uses: dtolnay/rust-toolchain@stable

- uses: Swatinem/rust-cache@v2

- name: Check documentation
run: cargo doc --no-deps --document-private-items
env:
RUSTDOCFLAGS: -D warnings
RUSTDOCFLAGS: "-Dwarnings"
14 changes: 5 additions & 9 deletions .github/workflows/publish.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,27 +13,23 @@ jobs:
name: Test before publish
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v6

- name: Install Rust
uses: dtolnay/rust-action@stable
with:
toolchain: stable
uses: dtolnay/rust-toolchain@stable

- name: Run tests
run: cargo test --verbose
run: cargo test --locked --verbose

publish:
name: Publish to crates.io
needs: test
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v6

- name: Install Rust
uses: dtolnay/rust-action@stable
with:
toolchain: stable
uses: dtolnay/rust-toolchain@stable

- name: Verify version matches tag
run: |
Expand Down
Loading