Repository navigation
Release 4.3.1 - #116
Merged
Merged
Release 4.3.1#116
Conversation
ubuntu-latest is a label GitHub moves. The image changes under us and a green pipeline turns red on a morning nobody touched the code. Pinning to ubuntu-24.04 means the runner moves when we move it. dtolnay/rust-toolchain was called at @stable, a branch, not a release. It is pinned to a commit, dated in the trailing comment because that repo publishes no release tag for it. Version-tagged actions are untouched.
The lint job ran an unpinned `pipx install ruff`, which picked up 0.16.9 and failed on 8 pre-existing errors (import order, __slots__ sort, SIM102, SIM201). The Rust job tracked `stable`, whose clippy now denies for_kv_map in src/node/base.rs. Both blocked unrelated PRs such as #92. Pin ruff==0.16.9 in the workflow and dev group, pin Rust 1.97.1 with clippy and rustfmt in rust-toolchain.toml and rust-tests.yml, and fix the errors in source.
…ore/pin-actions-sha
Fork PRs get a read-only GITHUB_TOKEN, so the comment step failed the job after the benchmark itself passed.
windows-latest and macos-latest were still floating in the wheel matrix.
rust-tests.yml and python-tests.yml published to crates.io and PyPI on every push to stable, each with a long-lived token. Publishing moves to publish.yml, triggered only by v* tags. Its first job refuses tags outside vMAJOR.MINOR.PATCH or vMAJOR.MINOR.PATCH-rc.N and any tag that does not equal the Cargo.toml version. Both test workflows run before any wheel is built, every build must succeed before a registry sees the release, PyPI uses trusted publishing in the pypi environment, crates.io runs in the release environment, and the last job creates the GitHub Release with an SPDX JSON SBOM attached. actions-rs/toolchain is archived and is replaced by actions-rust-lang/setup-rust-toolchain reading rust-toolchain.toml. Every workflow declares least-privilege permissions, every action is pinned to a commit SHA, and CLA calls the shared reusable workflow.
ruff 0.16 formats Python blocks in Markdown, so ruff format --check failed on README.md and the lint job only ran ruff check. Formatting it lets lint run both checks.
pyproject.toml and Cargo.toml both declared 4.2.0, two sources that publish.yml could only compare against one of. maturin fills a dynamic [project] version from Cargo.toml, so Cargo.toml is now the single source for crates.io, PyPI, and the tag check. poetry.lock and .flake8 are left over from before the move to uv and ruff. Nothing reads them.
#139 replaces long-lived registry tokens with OIDC. crates.io supports trusted publishing: rust-lang/crates-io-auth-action exchanges the job's OIDC token for a short-lived publish token, so CARGO_REGISTRY_TOKEN no longer needs to exist as a secret.
rust-tests.yml, python-tests.yml, the CLA caller, and the release steps of publish.yml now use the org workflows in blacklanternsecurity/CLA at one pinned SHA instead of carrying copies. - python: python-tests.yml derives the matrix from requires-python, replacing the literal 3.9 to 3.14 list, runs ruff check and ruff format --check (format was never checked here), and builds the extension with maturin develop when maturin is the backend. - rust: rust-tests.yml with --all-features --locked on the rust-toolchain.toml channel. - publish: release-check.yml validates the tag against Cargo.toml (now the single version source). The wheel matrix and the crates.io and PyPI uploads stay here because they are radixtarget-specific and PyPI trusted publishing does not work in a reusable workflow. publish.yml creates the release with the SPDX SBOM and attaches the wheels. - archive/** is no longer excluded: archive tags are not created.
Picks up secret-env skipping absent secrets on fork PRs and rust-tests running setup-script before clippy. No caller input changes.
e532142 sits on feat/shared-workflows, which was squash-merged and can stop resolving once the branch is deleted. 40c6e18 is CLA main and a superset: it adds optional registry login for image SBOMs to publish.yml, with defaults that leave existing callers unchanged. Refs blacklanternsecurity/bbot-enterprise#139
Bumps the github-actions group with 9 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `6` | `7` | | [actions-rust-lang/setup-rust-toolchain](https://github.com/actions-rust-lang/setup-rust-toolchain) | `1` | `2` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `5` | `7` | | [actions/github-script](https://github.com/actions/github-script) | `8` | `9` | | [actions/setup-python](https://github.com/actions/setup-python) | `6` | `7` | | [codecov/codecov-action](https://github.com/codecov/codecov-action) | `5` | `7` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `6` | `8` | | [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance) | `3` | `4` | | [actions/cache](https://github.com/actions/cache) | `4` | `6` | Updates `actions/checkout` from 6 to 7 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v6...v7) Updates `actions-rust-lang/setup-rust-toolchain` from 1 to 2 - [Release notes](https://github.com/actions-rust-lang/setup-rust-toolchain/releases) - [Changelog](https://github.com/actions-rust-lang/setup-rust-toolchain/blob/main/CHANGELOG.md) - [Commits](actions-rust-lang/setup-rust-toolchain@v1...v2) Updates `actions/upload-artifact` from 5 to 7 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@v5...v7) Updates `actions/github-script` from 8 to 9 - [Release notes](https://github.com/actions/github-script/releases) - [Commits](actions/github-script@v8...v9) Updates `actions/setup-python` from 6 to 7 - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](actions/setup-python@v6...v7) Updates `codecov/codecov-action` from 5 to 7 - [Release notes](https://github.com/codecov/codecov-action/releases) - [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md) - [Commits](codecov/codecov-action@v5...v7) Updates `actions/download-artifact` from 6 to 8 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](actions/download-artifact@v6...v8) Updates `actions/attest-build-provenance` from 3 to 4 - [Release notes](https://github.com/actions/attest-build-provenance/releases) - [Changelog](https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md) - [Commits](actions/attest-build-provenance@v3...v4) Updates `actions/cache` from 4 to 6 - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](actions/cache@v4...v6) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions-rust-lang/setup-rust-toolchain dependency-version: '2' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/upload-artifact dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/github-script dependency-version: '9' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/setup-python dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: codecov/codecov-action dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/download-artifact dependency-version: '8' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/attest-build-provenance dependency-version: '4' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/cache dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>
Follows .github-config#17 through CLA#11: publish.yml runs on push to the trunk instead of a v* tag, publishes in the release environment a bbot-leads member approves, re-runs safely (PyPI skip-existing, crates.io only when the version is new), and leaves the tag and the GitHub release to the bls-release App at the end of the run. The pypi environment and the long-lived registry token are gone.
# Conflicts: # .github/workflows/benchmark.yml # .github/workflows/python-tests.yml # pyproject.toml # radixtarget/test/test_rust_radixtarget.py # uv.lock
…ctions/dev/github-actions-e473bcc276 Bump the github-actions group across 1 directory with 9 updates
…r and patch (#106) * ci(dependabot): group updates weekly and auto-merge minor and patch Individual dependabot PRs pile up faster than one engineer can review them and go stale until they conflict (bbot-enterprise#141). Every ecosystem now runs weekly against dev and opens at most two grouped PRs: one for minor and patch bumps, one for majors. A pull_request_target workflow enables auto-merge (squash) on the minor/patch group so it lands once required checks pass. Majors still need a human. * ci(dependabot): call the shared auto-merge workflow The auto-merge job was a byte-identical copy in ten repositories. It now calls dependabot-auto-merge.yml in blacklanternsecurity/.github, pinned by SHA, so the fetch-metadata pin and merge policy live in one place. The trigger moves from pull_request_target to pull_request. Dependabot branches live in this repository, so the privileged target context was never needed and zizmor flags it as a dangerous trigger. The cargo ecosystem also scans /benchmark, which carries its own Cargo.toml and Cargo.lock that were previously never updated. * ci(dependabot): call auto-merge from the public CLA repository blacklanternsecurity/.github is private, so public repositories cannot call reusable workflows from it and the run failed as a workflow file issue. The shared workflow lives in blacklanternsecurity/CLA, which is public and already hosts cla-reusable.yml. * ci(dependabot): gate auto-merge on finished checks dev carries no required checks (#139), so gh pr merge --auto would merge immediately rather than on green. The shared workflow now waits for every other check on the head commit, refuses on failure or cancel, and merges with --match-head-commit. The caller grants checks: read so it can read check state. * ci(dependabot): pin the shared workflow to the current CLA tip Aligns with the SHA the other shared CLA workflows are pinned to. The auto-merge workflow is unchanged between the two commits. * ci(dependabot): pin auto-merge to CLA main at ad6e7d7 The e532142 pin filtered its own check by workflow name. Off the default branch GitHub reports that name as the file path, so the job waited on itself until the 3h timeout and never merged. CLA#7 drops the check by run id instead, and is on CLA main.
- publish: build wheels through CLA's maturin-wheels, which installs every interpreter requires-python allows, so Windows and macOS ship per-version wheels again; publish crates.io through CLA's crates.yml after PyPI; pass no App credentials - python-tests, rust-tests, cla: CODECOV_TOKEN and the CLA App credentials by name instead of secrets: inherit; drop the stable push triggers that duplicated the publish calls - python-tests: keep reporting the required test (3.11) to (3.15) contexts from the real result until the ruleset moves - stable-guard: refuse a pull request into stable whose version or dependencies cannot release - benchmark: explicit permissions and a pinned runner - re-pin every CLA reference to CLA#11
# Conflicts: # .github/workflows/benchmark.yml # .github/workflows/python-tests.yml # .github/workflows/rust-tests.yml
4.3.0 is on PyPI and crates.io with no v4.3.0 tag, so release-check would refuse it as partly published.
Bumps [ruff](https://github.com/astral-sh/ruff) from 0.17.1 to 0.17.2. - [Release notes](https://github.com/astral-sh/ruff/releases) - [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md) - [Commits](astral-sh/ruff@0.17.1...0.17.2) --- updated-dependencies: - dependency-name: ruff dependency-version: 0.17.2 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
…t releasing
publish.yml drops to permissions: {} and grants contents read per job.
check also gets actions and pull-requests read for CLA#11's provenance
check and environment guard.
dependabot-auto-merge.yml is removed. Once dev drops to zero approvals
it would merge Dependabot PRs on CI alone (pjhartlieb).
The README gains a Releasing section: the four release approvals per
run, and that PyPy and free-threaded interpreters get the sdist since
the shared wheel build covers default CPython only.
…ta-dev Update license metadata to AGPL-3.0-or-later (dev)
…uff-0.17.2 Bump ruff from 0.17.1 to 0.17.2
# Conflicts: # uv.lock
Move every CLA reusable workflow call to blacklanternsecurity/release-workflows at v1.0.0 and pass BLS_RELEASE_PRIVATE_KEY to the release-check and publish calls, which receive release-environment secrets only when mapped.
ci: shared tests and release on merge to stable, version from Cargo.toml
Brings #108 (AGPL-3.0 license metadata) and #111 (pinned runner image, ruff, Rust toolchain) into dev. The three workflow conflicts keep dev's versions from #110: they call release-workflows v1.0.0, which already pins the runner image and actions, and rust-toolchain.toml pins Rust 1.97.1 on both branches.
RadixTarget Benchmark Results100000 networks per table, 100000 lookups, median of 5 runs (seed 1337).
Change is in time taken: negative is faster. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## stable #116 +/- ##
=====================================
Coverage 100% 100%
=====================================
Files 3 3
Lines 605 605
=====================================
Hits 605 605 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Promotes
devtostableas 4.3.1, the first release through the new flow (publishing policy 1.5.0):publish.ymlandstable-guard(#110), shared tests from release-workflows v1.0.0, and the version fromCargo.toml.The branch is
devplus a merge ofstable, so the PR merges cleanly; its tree is identical todev. The three workflow conflicts keep #110's versions: they call release-workflows v1.0.0, which already pins what #111 pinned.On merge,
publish.ymlpauses at each job in thereleaseenvironment (the credential check, PyPI, crates.io, and the tag and release) for abbot-leadsapproval, not the merger's. PyPI and crates.io publish by trusted publishing, and thebls-releaseApp tagsv4.3.1. The provenance check starts fromv4.3.0, tagged today on3317d3e(#105), the commit 4.3.0 was built from.