Repository navigation
fix(renovate): bind CI pins to source - #425
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Rust toolchain inputs supplied by step outputs failed the dependency gate even when mise had checked the corresponding literal pin.
A matching dependency name also admitted a locked mise record without checking its committed declaration.
Changes
Bind the two supported Rust readers to regular UTF-8 Git blobs from the offered commit.
Check exact scripts, every matching consumer, unique producers, immutable Action references, controller identity and checkout guards, and one successful source-matched literal counterpart.
Reject duplicate keys, unsupported YAML features, and raw C0 characters that can hide trailing data.
Limit input to 128 KiB and collection nesting to 64 levels.
Apply source binding to locked mise dependencies and the existing HTTP release counterpart.
Keep version-only HTTP table changes subject to freshness checks and add source-bound saved-report inspection.
Include composite Action metadata in manifest detection.
Register the actual parser fuzz target and the character predicate's Kani obligation with three rejecting controls.
Include embedded workflow fixtures in the build fingerprint and align spelling checks with the existing binary corpus classification.
The 32 profile manifest changes contain only the owner-map hash, and all 16 Windows manifests match native Windows output.
Validation
mise x -- just checkpassed.The implementation-bound character proof and all three rejecting controls passed through the bounded project driver.
The AddressSanitizer parser campaign loaded all seven committed seeds, including the NUL counterexample, and completed 1,024 runs with fixed seed 1.
Native Bash and pinned PowerShell reader checks passed on macOS, and the PowerShell, character predicate, and source-blob regressions passed on Windows.
The complete saved Renovate report for unchanged
find-my-filescommit 05ce0eaf passed source-bound inspection with 134 selected update candidates and zero notices.The report inspection establishes lookup validity rather than freshness for every existing version.
Closes #222.
@coderabbitai ignore