diff --git a/.github/renovate.json b/.github/renovate.json new file mode 100644 index 00000000..9f2975bf --- /dev/null +++ b/.github/renovate.json @@ -0,0 +1,24 @@ +{ + "$schema": "https://docs.renovatebot.com/renovate-schema.json", + "extends": [ + "config:best-practices", + ":semanticCommits", + ":semanticCommitTypeAll(chore)", + ":dependencyDashboard" + ], + "labels": ["dependencies"], + "prConcurrentLimit": 5, + "schedule": ["before 06:00 on monday"], + "packageRules": [ + { + "matchManagers": ["github-actions"], + "groupName": "github-actions", + "pinDigests": true + }, + { + "matchManagers": ["cargo"], + "groupName": "cargo (minor/patch)", + "matchUpdateTypes": ["minor", "patch"] + } + ] +} diff --git a/.github/workflows/bench.yml b/.github/workflows/bench.yml index d08d1faa..6401d342 100644 --- a/.github/workflows/bench.yml +++ b/.github/workflows/bench.yml @@ -102,9 +102,11 @@ jobs: name: thesis-gate bench runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: dtolnay/rust-toolchain@stable - - uses: Swatinem/rust-cache@v2 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + - uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 # master (pinned); channel via toolchain input + with: + toolchain: stable + - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 - name: Build (release — §3.7 pins release mode for A1) run: cargo build -p ourios-bench --release @@ -303,7 +305,7 @@ jobs: - name: Upload results JSON if: always() - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: bench-results path: bench-results/*.json diff --git a/.github/workflows/capture-otel-demo-corpus.yml b/.github/workflows/capture-otel-demo-corpus.yml index bdfbae8d..f0090ddf 100644 --- a/.github/workflows/capture-otel-demo-corpus.yml +++ b/.github/workflows/capture-otel-demo-corpus.yml @@ -98,7 +98,7 @@ jobs: COMPOSE_FILE: docker-compose.yml:${{ github.workspace }}/.github/otel-demo-capture-compose-override.yml steps: - name: Checkout ourios (for the collector overlay) - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 - name: Clone opentelemetry-demo env: @@ -320,7 +320,7 @@ jobs: - name: Upload corpus + manifest if: always() - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: otel-demo-corpus path: | diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 1ae69a71..786686e2 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -14,14 +14,20 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: ${{ github.ref != 'refs/heads/main' }} +# Least-privilege default for the whole workflow; jobs that need more +# (coverage publishes the badge branch) escalate at the job level. +permissions: + contents: read + jobs: fmt: name: cargo fmt runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: dtolnay/rust-toolchain@stable + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + - uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 # master (pinned); channel via toolchain input with: + toolchain: stable components: rustfmt - run: cargo fmt --all --check @@ -29,11 +35,12 @@ jobs: name: cargo clippy runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: dtolnay/rust-toolchain@stable + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + - uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 # master (pinned); channel via toolchain input with: + toolchain: stable components: clippy - - uses: Swatinem/rust-cache@v2 + - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 - run: cargo clippy --all-targets --all-features -- -D warnings docs: @@ -42,11 +49,13 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 with: persist-credentials: false - - uses: dtolnay/rust-toolchain@stable - - uses: Swatinem/rust-cache@v2 + - uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 # master (pinned); channel via toolchain input + with: + toolchain: stable + - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 # The [workspace.lints.rustdoc] levels are the single source of # truth: the deny-level lints (broken intra-doc links etc., # #124) fail this build on their own; no RUSTDOCFLAGS override, @@ -57,23 +66,25 @@ jobs: name: cargo test runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: dtolnay/rust-toolchain@stable - - uses: Swatinem/rust-cache@v2 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + - uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 # master (pinned); channel via toolchain input + with: + toolchain: stable + - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 - run: cargo test --all-features book: name: mdbook build runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: peaceiris/actions-mdbook@v2 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + - uses: peaceiris/actions-mdbook@ee69d230fe19748b7abf22df32acaa93833fad08 # v2 with: mdbook-version: '0.5.2' # RFC diagrams are Mermaid (docs/rfcs/README.md). The # preprocessor is declared in book.toml, so the binary must be # on PATH or `mdbook build` fails with "preprocessor not found". - - uses: taiki-e/install-action@v2 + - uses: taiki-e/install-action@7a79fe8c3a13344501c80d99cae481c1c9085912 # v2 with: tool: mdbook-mermaid@0.17.0 - run: mdbook build @@ -93,11 +104,12 @@ jobs: # (open-telemetry/weaver release asset). Bump both together. WEAVER_SHA256: a9822c712d6871bd89d6530f18c5df5cea3821f642e7b8e5e49e985917f7d12d steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 with: persist-credentials: false - - uses: dtolnay/rust-toolchain@stable + - uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 # master (pinned); channel via toolchain input with: + toolchain: stable components: rustfmt - name: Install weaver run: | @@ -149,19 +161,22 @@ jobs: # `badges` branch via the contents API; everything else is read. contents: write steps: - - uses: actions/checkout@v4 - - uses: dtolnay/rust-toolchain@stable + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + - uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 # master (pinned); channel via toolchain input with: + toolchain: stable components: llvm-tools-preview - - uses: Swatinem/rust-cache@v2 - - uses: taiki-e/install-action@cargo-llvm-cov + - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 + - uses: taiki-e/install-action@7a79fe8c3a13344501c80d99cae481c1c9085912 # v2 + with: + tool: cargo-llvm-cov # Collect once (runs the test suite under instrumentation), then # render each format from the same profile data — no double run. - run: cargo llvm-cov --workspace --all-features --no-report - run: cargo llvm-cov report --summary-only - run: cargo llvm-cov report --lcov --output-path lcov.info - run: cargo llvm-cov report --html --output-dir coverage-html - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: coverage path: | diff --git a/.github/workflows/commitlint.yml b/.github/workflows/commitlint.yml index b2332115..a7a7cad8 100644 --- a/.github/workflows/commitlint.yml +++ b/.github/workflows/commitlint.yml @@ -1,14 +1,17 @@ name: Commitlint (advisory) on: [pull_request] +permissions: + contents: read + jobs: commitlint: runs-on: ubuntu-latest continue-on-error: true steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 with: { fetch-depth: 0 } - - uses: wagoid/commitlint-github-action@v6 + - uses: wagoid/commitlint-github-action@b948419dd99f3fd78a6548d48f94e3df7f6bf3ed # v6 with: configFile: .commitlintrc.yml failOnWarnings: false diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml index 1149d761..af2485f9 100644 --- a/.github/workflows/pages.yml +++ b/.github/workflows/pages.yml @@ -25,24 +25,24 @@ jobs: build: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 - name: Install mdBook - uses: peaceiris/actions-mdbook@v2 + uses: peaceiris/actions-mdbook@ee69d230fe19748b7abf22df32acaa93833fad08 # v2 with: mdbook-version: '0.5.2' # The Mermaid preprocessor (declared in book.toml) must be on # PATH or `mdbook build` fails; see docs/rfcs/README.md. - name: Install mdbook-mermaid - uses: taiki-e/install-action@v2 + uses: taiki-e/install-action@7a79fe8c3a13344501c80d99cae481c1c9085912 # v2 with: tool: mdbook-mermaid@0.17.0 - name: Build book run: mdbook build - - uses: actions/upload-pages-artifact@v3 + - uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3 with: path: ./book @@ -54,4 +54,4 @@ jobs: url: ${{ steps.deployment.outputs.page_url }} steps: - id: deployment - uses: actions/deploy-pages@v4 + uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4 diff --git a/.github/workflows/pr-title.yml b/.github/workflows/pr-title.yml index 9d9907e9..d6fbc086 100644 --- a/.github/workflows/pr-title.yml +++ b/.github/workflows/pr-title.yml @@ -10,7 +10,7 @@ jobs: lint: runs-on: ubuntu-latest steps: - - uses: amannn/action-semantic-pull-request@v5 + - uses: amannn/action-semantic-pull-request@e32d7e603df1aa1ba07e981f2a23455dee596825 # v5 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: diff --git a/.github/workflows/query-bench.yml b/.github/workflows/query-bench.yml index a84c1ee5..60ed5296 100644 --- a/.github/workflows/query-bench.yml +++ b/.github/workflows/query-bench.yml @@ -68,14 +68,16 @@ jobs: name: B1/B2 query gates runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 # We read the corpus via `gh release download` (GH_TOKEN env), # not git, so don't leave the checkout token persisted in # `.git/config` on the runner. with: persist-credentials: false - - uses: dtolnay/rust-toolchain@stable - - uses: Swatinem/rust-cache@v2 + - uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 # master (pinned); channel via toolchain input + with: + toolchain: stable + - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 - name: Fetch OTel Demo corpora (frozen release assets) id: fetch @@ -242,7 +244,7 @@ jobs: - name: Upload query-bench artifact if: always() - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: query-bench path: | diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 40c167d8..14b2346b 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -10,17 +10,18 @@ jobs: changelog: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 with: fetch-depth: 0 + persist-credentials: false - name: Generate changelog - uses: orhun/git-cliff-action@v4 + uses: orhun/git-cliff-action@f50e11560dce63f7c33227798f90b924471a88b5 # v4 with: config: cliff.toml args: --latest --strip header env: OUTPUT: CHANGES.md - name: Create GitHub Release - uses: softprops/action-gh-release@v2 + uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2 with: body_path: CHANGES.md diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 1ee5c1cc..8668d4c2 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -24,14 +24,14 @@ jobs: id-token: write security-events: write steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 with: persist-credentials: false - - uses: ossf/scorecard-action@v2.4.0 + - uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.4.0 with: results_file: results.sarif results_format: sarif publish_results: true - - uses: github/codeql-action/upload-sarif@v3 + - uses: github/codeql-action/upload-sarif@dd903d2e4f5405488e5ef1422510ee31c8b32357 # v3 with: sarif_file: results.sarif