From 66a33bfd32c3fa7fbbca29abb1dbb4ba78cc2cf4 Mon Sep 17 00:00:00 2001 From: Aria Desires Date: Thu, 10 Apr 2025 09:43:13 -0400 Subject: [PATCH] update cargo-dist (#17325) Putting this up to confirm that it does what it should: * undirty the release.yml by including action-commits in the config * add persist-credentials=false hardening --- .github/workflows/release.yml | 33 +++++++++++++++++++-------------- Cargo.toml | 11 +++++++---- 2 files changed, 26 insertions(+), 18 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index f5ad2f5520..c12aa00fc1 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,5 +1,6 @@ # This file was autogenerated by dist: https://github.com/astral-sh/cargo-dist # +# Copyright 2022-2024, axodotdev # Copyright 2025 Astral Software Inc. # SPDX-License-Identifier: MIT or Apache-2.0 # @@ -59,16 +60,17 @@ jobs: env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 with: + persist-credentials: false submodules: recursive - name: Install dist # we specify bash to get pipefail; it guards against the `curl` command # failing. otherwise `sh` won't catch that `curl` returned non-0 shell: bash - run: "curl --proto '=https' --tlsv1.2 -LsSf https://github.com/astral-sh/cargo-dist/releases/download/v0.28.3/cargo-dist-installer.sh | sh" + run: "curl --proto '=https' --tlsv1.2 -LsSf https://github.com/astral-sh/cargo-dist/releases/download/v0.28.4-prerelease.1/cargo-dist-installer.sh | sh" - name: Cache dist - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 with: name: cargo-dist-cache path: ~/.cargo/bin/dist @@ -84,7 +86,7 @@ jobs: cat plan-dist-manifest.json echo "manifest=$(jq -c "." plan-dist-manifest.json)" >> "$GITHUB_OUTPUT" - name: "Upload dist-manifest.json" - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 with: name: artifacts-plan-dist-manifest path: plan-dist-manifest.json @@ -121,18 +123,19 @@ jobs: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} BUILD_MANIFEST_NAME: target/distrib/global-dist-manifest.json steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 with: + persist-credentials: false submodules: recursive - name: Install cached dist - uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4.2.1 + uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e with: name: cargo-dist-cache path: ~/.cargo/bin/ - run: chmod +x ~/.cargo/bin/dist # Get all the local artifacts for the global tasks to use (for e.g. checksums) - name: Fetch local artifacts - uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4.2.1 + uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e with: pattern: artifacts-* path: target/distrib/ @@ -150,7 +153,7 @@ jobs: cp dist-manifest.json "$BUILD_MANIFEST_NAME" - name: "Upload artifacts" - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 with: name: artifacts-build-global path: | @@ -171,18 +174,19 @@ jobs: outputs: val: ${{ steps.host.outputs.manifest }} steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 with: + persist-credentials: false submodules: recursive - name: Install cached dist - uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4.2.1 + uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e with: name: cargo-dist-cache path: ~/.cargo/bin/ - run: chmod +x ~/.cargo/bin/dist # Fetch artifacts from scratch-storage - name: Fetch artifacts - uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4.2.1 + uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e with: pattern: artifacts-* path: target/distrib/ @@ -196,7 +200,7 @@ jobs: cat dist-manifest.json echo "manifest=$(jq -c "." dist-manifest.json)" >> "$GITHUB_OUTPUT" - name: "Upload dist-manifest.json" - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 with: # Overwrite the previous copy name: artifacts-dist-manifest @@ -246,12 +250,13 @@ jobs: env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 with: + persist-credentials: false submodules: recursive # Create a GitHub Release while uploading all files to it - name: "Download GitHub Artifacts" - uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4.2.1 + uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e with: pattern: artifacts-* path: artifacts diff --git a/Cargo.toml b/Cargo.toml index 87a8675382..0e4efb9004 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -272,7 +272,7 @@ inherits = "release" # Config for 'dist' [workspace.metadata.dist] # The preferred dist version to use in CI (Cargo.toml SemVer syntax) -cargo-dist-version = "0.28.3" +cargo-dist-version = "0.28.4-prerelease.1" # CI backends to support ci = "github" # The installers to generate for each app @@ -329,9 +329,12 @@ github-custom-job-permissions = { "build-docker" = { packages = "write", content install-updater = false # Path that installers should place binaries in install-path = ["$XDG_BIN_HOME/", "$XDG_DATA_HOME/../bin", "~/.local/bin"] -# Temporarily allow changes to the `release` workflow, in which we pin actions -# to a SHA instead of a tag (https://github.com/astral-sh/uv/issues/12253) -allow-dirty = ["ci"] [workspace.metadata.dist.github-custom-runners] global = "depot-ubuntu-latest-4" + +[workspace.metadata.dist.github-action-commits] +"actions/checkout" = "11bd71901bbe5b1630ceea73d27597364c9af683" # v4 +"actions/upload-artifact" = "ea165f8d65b6e75b540449e92b4886f43607fa02" # v4.6.2 +"actions/download-artifact" = "95815c38cf2ff2164869cbab79da8d1f422bc89e" # v4.2.1 +"actions/attest-build-provenance" = "c074443f1aee8d4aeeae555aebba3282517141b2" #v2.2.3