From 2b07c6c267e489782f970be9e430ed3494ad6309 Mon Sep 17 00:00:00 2001 From: Christophe Pettus Date: Sun, 7 Jun 2026 19:43:09 -0700 Subject: [PATCH] ci: move off deprecated Node 20 actions GitHub forces Node 24 on Node 20 actions starting 2026-06-16. Two were still on Node 20: - pypa/cibuildwheel v2.19 -> v3.4.1: its internal actions/setup-python is now v6.2.0 (Node 24). Pin manylinux2014 so the major bump keeps the Linux wheels' glibc-2.17 floor (64-bit only, so the i686/libatomic issue does not apply). - rustsec/audit-check has no Node 24 release, so the audit job now runs `cargo audit` directly (install + run), dropping the action and its write permissions. peter-evans/* in bench.yml are already Node 24. --- .github/workflows/ci.yml | 13 ++++++------- .github/workflows/wheels.yml | 7 ++++++- 2 files changed, 12 insertions(+), 8 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 722bcd3..cd258f6 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -73,15 +73,14 @@ jobs: # accumulate silently. audit: runs-on: ubuntu-latest - permissions: - contents: read - pull-requests: write - checks: write steps: - uses: actions/checkout@v5 - - uses: rustsec/audit-check@v1.4.1 - with: - token: ${{ secrets.GITHUB_TOKEN }} + - uses: dtolnay/rust-toolchain@stable + # Run cargo audit directly rather than rustsec/audit-check, which is + # pinned to the deprecated Node 20 runtime (it has no Node 24 release). + - name: Install cargo-audit + run: cargo install cargo-audit --locked + - run: cargo audit # I55 (ISSUES.md, 2026-05-22): pin MSRV in CI. Cargo.toml declares # rust-version = "1.82" (the floor stabilized by Option::is_none_or in diff --git a/.github/workflows/wheels.yml b/.github/workflows/wheels.yml index 2557471..5f7c8b2 100644 --- a/.github/workflows/wheels.yml +++ b/.github/workflows/wheels.yml @@ -48,7 +48,7 @@ jobs: targets: aarch64-apple-darwin, x86_64-apple-darwin - name: Build wheels - uses: pypa/cibuildwheel@v2.19 + uses: pypa/cibuildwheel@v3.4.1 env: CIBW_BUILD: "cp311-* cp312-* cp313-*" CIBW_SKIP: "*-musllinux_*" @@ -68,6 +68,11 @@ jobs: CIBW_BEFORE_BUILD: "pip install maturin" CIBW_BEFORE_ALL_LINUX: "curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal" CIBW_ENVIRONMENT_LINUX: 'PATH="$HOME/.cargo/bin:$PATH"' + # Pin the manylinux image (broad glibc-2.17 compat) so the + # cibuildwheel v3 bump does not shift the Linux wheels' glibc + # floor. 64-bit only, so the i686 libatomic issue does not apply. + CIBW_MANYLINUX_X86_64_IMAGE: manylinux2014 + CIBW_MANYLINUX_AARCH64_IMAGE: manylinux2014 CIBW_TEST_REQUIRES: "pytest hypothesis" CIBW_TEST_COMMAND: "pytest {package}/tests" with: