[robobun]

Problem

• Every Actions job here fails at "Set up job", so bun has no CI signal. Example: run 35174531529. The annotation: The actions actions/checkout@v4, dtolnay/rust-toolchain@stable, and actions/cache@v4 are not allowed in oven-sh/lol-html because all actions must be pinned to a full-length commit SHA.
• bun.yml runs cargo test --features=integration_test. Upstream 776b44a (v3.0.0) renamed the feature to _integration_test. On the v3.0.1 base, cargo stops with error: the package 'lol_html' does not contain this feature: integration_test.

Fix

• Pin every uses: in bun.yml, ci.yml and semgrep.yml to the commit that its tag points to today, with the version in a comment. This is the commit of ci: pin workflow actions to full commit SHAs #7 on the new base, so this PR replaces ci: pin workflow actions to full commit SHAs #7.
• Pin dtolnay/rust-toolchain to its v1 tag and pass toolchain: stable. Its README requires a pinned commit to be on master. The commit behind @stable is not.
• Pass --features=_integration_test in bun.yml, as scripts/test.sh and ci.yml already do.
• Verified on this PR: every job gets past "Set up job". cargo test (the bun workflow) passes: 207 + 3 + 38 + 2 tests on stable 1.98.1. semgrep-oss passes. Test and Clippy and format fail on defects already on bun (Notes).

Background

• oven-sh/bun builds the lol_html crate from a commit on the bun branch of this fork. A workflow-only commit needs no pin bump there.
• bun.yml is the workflow of the fork. ci.yml and semgrep.yml come from upstream and also run on every pull request here.
• "Set up job" downloads each action and applies the organization policy before a step runs.

Notes

Pins

action	commit	tag
actions/checkout (bun.yml, ci.yml)	11d5960a326750d5838078e36cf38b85af677262	v4.4.0 (what v4 points to)
actions/cache (bun.yml, ci.yml)	0057852bfaa89a56745cba8c7296529d2fc39830	v4.3.0 (what v4 points to)
actions/setup-node	49933ea5288caeca8642d1e84afbd3f7d6820020	v4.4.0 (what v4 points to)
obi1kenobi/cargo-semver-checks-action	6b69fcf40e9b5fb17adeb57e4b6ecd020649a239	v2.9 (what v2 points to)
dtolnay/rust-toolchain	02cb101ec7c40f2c49e1d9714d64511d8e1b74de	v1, plus toolchain: stable
actions/checkout (semgrep.yml)	fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09	v5.1.0 (what v5 points to)
actions/cache (semgrep.yml)	caa296126883cff596d87d8935842f9db880ef25	v5.1.0 (what v5 points to)

Check of each uses: owner/repo@sha # tag line against repos/<repo>/git/ref/tags/<tag> (2026-09-22):

OK   actions/cache v4.3.0 -> 0057852bfaa89a56745cba8c7296529d2fc39830 (commit signature verified: true)
OK   actions/cache v5.1.0 -> caa296126883cff596d87d8935842f9db880ef25 (commit signature verified: true)
OK   actions/checkout v4.4.0 -> 11d5960a326750d5838078e36cf38b85af677262 (commit signature verified: true)
OK   actions/checkout v5.1.0 -> fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 (commit signature verified: true)
OK   actions/setup-node v4.4.0 -> 49933ea5288caeca8642d1e84afbd3f7d6820020 (commit signature verified: true)
OK   dtolnay/rust-toolchain v1 -> 02cb101ec7c40f2c49e1d9714d64511d8e1b74de (commit signature verified: true)
OK   obi1kenobi/cargo-semver-checks-action v2.9 -> 6b69fcf40e9b5fb17adeb57e4b6ecd020649a239 (commit signature verified: true)

No uses: line without a full SHA remains in .github/workflows/. No pinned action pulls in a second action: six are JavaScript actions, and dtolnay/rust-toolchain is a composite action with run: steps only.

Differences from #7

#7 was opened on the v2.7.2 lineage of bun. After the rebase onto v3.0.1 it shows 30 changed files and does not merge. The first commit here is the commit of #7 (2151cac) cherry-picked onto e1a306d, with the credit to @sosukesuzuki kept. Two things differ:

• semgrep.yml: upstream rewrote the file. It now uses actions/checkout@v5 and actions/cache@v5. The commit keeps the upstream file and pins those two lines.
• dtolnay/rust-toolchain: the v1 tag moved from 6c977a6c to 02cb101e (2026-09-12) after ci: pin workflow actions to full commit SHAs #7 was opened. The new commit is master HEAD. Compared with the commit behind @stable, it passes --force-non-host to rustup toolchain install and rustup default. That flag only allows a toolchain for another host, so it changes nothing for stable on the runner. The toolchain step passes in all three Rust jobs of this PR.

dtolnay/rust-toolchain

• The README says: "it is required that you pick a SHA that is within the history of the master branch. Any commit that is not within the history of master will eventually get garbage-collected and your workflows will fail."
• @stable is 6bed0761d98439e5a578e2877258200ad565ba87 today. It is one commit on top of master commit d1031067. That commit only changes action.yml: toolchain gets required: false and default: stable. compare/master...stable reports diverged.

The feature name

cargo test --features=integration_test --no-run on e1a306d:

error: the package 'lol_html' does not contain this feature: integration_test
help: there is a similarly named feature: _integration_test

cargo test --features=_integration_test --target-dir=target on this branch: 207 + 3 + 38 + 2 tests pass, locally and in run 35728372731.

What the upstream jobs report after the pin

ci.yml sets RUSTFLAGS=-Dwarnings. In run 35728372762, Test fails in Run Rust tests and Clippy and format fails in Run clippy, on the same errors. They come from 230e863 (content-handler suspension), which is on bun today. This PR does not change them:

• error: unused import: Cell at src/rewriter/mod.rs:2089:25.
• error: hidden lifetime parameters in types are deprecated at src/rewriter/settings.rs:531:49, from the text! macro.
• Behind these, c-api does not compile: error[E0277]: *mut libc::c_void cannot be sent between threads safely in 4 places. cargo clippy --all-targets --manifest-path=c-api/Cargo.toml shows it locally.

#8 fixes these defects, but on the old lineage. I checked its commits on top of this branch, locally, with stable 1.98.1 and the environment of ci.yml:

• 00871c5 applies when its rustfmt hunk for src/selectors_vm/mod.rs is dropped. The new base has that code from upstream, already formatted. 9a16a33 applies cleanly.
• With those two commits, cargo fmt -- --check, the four cargo clippy steps, cargo doc and scripts/test.sh pass (207 + 3 + 38 + 2 library tests, 8 C API tests). I did not run the wasm-pack JS tests.
• baeee5f (skip Check semver on the fork) is not needed on the new base. RewritingError is #[non_exhaustive] since v3.0.0, so the Suspended variant is not a breaking change. cargo semver-checks check-release --package lol_html --default-features (0.50.0) reports 223 pass, 31 skip and no semver update required.

semgrep-oss on the fork

Upstream replaced semgrep ci with semgrep scan --config=auto, which needs no token. In run 35728372722 it ran 259 rules on 502 files and printed 523 findings. The step exits 0 with findings, so the job is green.

Scope

This PR changes .github/workflows/ only. It covers bun. The main branch of the fork mirrors upstream and keeps the tag refs, so a run on main still fails at "Set up job".

Rebase cost

At the next git rebase --onto <new-tag>, the pin commit conflicts where upstream changed a uses: line or the lines next to it. Take the upstream file and pin its uses: lines. The header of bun.yml states the rule.

[robobun]

Status

• Reproduced the policy failure: every check on bun fails at "Set up job" (run 35174531529). gh api repos/oven-sh/lol-html/check-runs/105053198840/annotations returns the policy message that the PR body quotes.
• Reproduced the feature error: on e1a306d, cargo test --features=integration_test --no-run prints error: the package 'lol_html' does not contain this feature: integration_test.
• CI on this PR (ac8eb06): every job gets past "Set up job".
  • cargo test passes: 207 + 3 + 38 + 2 tests on stable 1.98.1 (run 35728372731).
  • semgrep-oss passes (run 35728372722).
  • Test and Clippy and format fail on defects already on bun, in src/ and c-api/ (run 35728372762). This PR changes .github/workflows/ only. Fix the defects that upstream's CI reports on the bun branch (cherry-pick from #3) #8 has the fixes for these and needs a rebase onto the new base. The Notes in the PR body have the details.
• This PR replaces ci: pin workflow actions to full commit SHAs #7.