Repository navigation
ci: checks fetch their own pinned, sha-verified tools (nextest, deny, jq) - #1035
Merged
Merged
Conversation
… jq)
Owner ruling (relayed by ModernCI, 2026-10-14): the tenant owns its CI config
and toolchain; ModernCI runs what the YAML says. ModernCI stopped providing
cargo-nextest and cargo-deny on its EC2 backend (Latchkey follows), so each
check now fetches what it uses.
.ci/tool.sh (POSIX sh, sourced: `. .ci/tool.sh nextest deny jq`) puts each tool
at its pinned version on PATH: a tool already on PATH at exactly the pin is
used; else the official release asset is downloaded with curl, verified against
the sha256 pinned in the script, and cached under
${MODERNCI_CACHE_DIR:-${XDG_CACHE_HOME:-$HOME/.cache}}/busbar-ci-tools/<tool>-<version>/.
Unsupported platform or sha mismatch prints a message and returns 1.
Platforms: linux x86_64, linux aarch64, darwin arm64.
.ci/default.yaml: test and test-gated source it for nextest and jq; deny sources
it for deny and drops `requires: [cargo-deny]`. Check bodies are otherwise
unchanged; `requires: [git-history]` is kept.
Pins (sha256):
cargo-nextest 0.9.148
x86_64-unknown-linux-gnu 223ba936714cc861a9cdedad5a8eb664dfdd69d6fbdf6cea6aa8184f523290dc
aarch64-unknown-linux-gnu 81469eb963ef883fd590e60189e77d6aba3d91b418591d3391f50fe3e9480d2b
universal-apple-darwin 6c23b7fb4ca82c571fc8dfedbab45bfa773d45918f933170c85d21cd7f4b852b
cargo-deny 0.20.2
x86_64-unknown-linux-musl 9f12ed4c49936e09b48bf862b595cde2fe64fcbd9d74dfacac6131ca824c8d5f
aarch64-unknown-linux-musl 995c82be0defc7a025cae49a2aa2644ce8245c9a3318fc4103907c6a285e8c7d
aarch64-apple-darwin fe67d82a10d8597a3549364cb733a3f9cc1bfff9031b7ae46384a9f2a72090c3
jq 1.7.1
jq-linux-amd64 5942c9b0934e510ee61eb3e30273f1b3fe2590df93933a93d7c58b81d19c8ff5
jq-linux-arm64 4dd2d8a0661df0b22f1bb9a1f9830f06b6f3b8f7d91211a1ef5d7c4f06a8b4a5
jq-macos-arm64 0bbe619e663e0de2c550be2fe0d240d076799d6f8a652b70fa04aea8a8362e8a
… drops XDG
ModernCI guarantees only Linux, sh, git, curl, tar and CA certs. `. .ci/tool.sh rust`
leaves an existing cargo alone; otherwise it fetches rustup-init 1.28.2 from
static.rust-lang.org, verifies the pinned sha256 (cross-checked against the published
.sha256), runs it with --default-toolchain none and RUSTUP_HOME/CARGO_HOME under the
cache root, and prepends $CARGO_HOME/bin (rust-toolchain.toml picks the toolchain).
Every cargo-running check in .ci/default.yaml (preflight, gates, clippy, compile, test,
test-gated, doctest, deletion-matrix, deny, oracle) now starts with `. .ci/tool.sh rust ...`.
Cache root is ${MODERNCI_CACHE_DIR:-$HOME/.cache}/busbar-ci-tools.
rustup-init 1.28.2 sha256:
x86_64-unknown-linux-gnu 20a06e644b0d9bd2fbdbfd52d42540bdde820ea7df86e92e533c073da0cdd43c
aarch64-unknown-linux-gnu e3853c5a252fca15252d07cb23a1bdd9377a8c6f3efa01531109281ae47f841c
aarch64-apple-darwin 20ef5516c31b1ac2290084199ba77dbbcaa1406c45c1d978ca68558ef5964ef5
…er bootstrapping rustup rustup 1.28.0 removed the implicit install of the rust-toolchain.toml channel. When rustup is the one tool.sh bootstrapped, it now runs `rustup toolchain install` from the repo root (installs the toolchain and components the file names; a no-op once present). An existing cargo on PATH is left untouched.
MattJackson
added a commit
that referenced
this pull request
Oct 14, 2026
… tenant owns toolchain; operator removed Rust on v0.4.1448). Each cargo check sources .ci/tool.sh when present (#1035) else the inline BUSBAR_TOOL_SH (pinned, sha-verified rustup-init 1.28.2 + rustup toolchain install, nextest 0.9.148, deny 0.20.2, jq 1.7.1). Also re-syncs with predev's file (#924 example cdylib builds; git-history on gates).
MattJackson
added a commit
that referenced
this pull request
Oct 14, 2026
…tenant owns toolchain; operator removed Rust on v0.4.1448). Each cargo check sources .ci/tool.sh when present (#1035) else the inline BUSBAR_TOOL_SH (pinned, sha-verified rustup-init 1.28.2 + rustup toolchain install, nextest 0.9.148, deny 0.20.2, jq 1.7.1). Also re-syncs with predev's file (#924 example cdylib builds; git-history on gates).
…their own pinned toolchain; owner ruling 2026-10-14
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Owner ruling (relayed by ModernCI): the tenant owns its CI config and toolchain. ModernCI removed cargo-nextest and cargo-deny from its EC2 backend (Latchkey next), so the checks fetch them.
.ci/tool.sh(sourced POSIX sh): puts pinned nextest 0.9.148, cargo-deny 0.20.2, jq 1.7.1 on PATH; uses an already-present exact version, else downloads the official release asset, verifies the pinned sha256, caches under${MODERNCI_CACHE_DIR:-${XDG_CACHE_HOME:-$HOME/.cache}}/busbar-ci-tools/. Platforms: linux x86_64/aarch64, darwin arm64. Mismatch or unsupported platform returns 1..ci/default.yaml: test, test-gated (nextest, jq) and deny (deny) source it;requires: [cargo-deny]removed from deny;requires: [git-history]kept; bodies otherwise unchanged..ci/predev.yamlis not touched: row 163: the predev→dev move is judged absolute and from predev's own oracle pin (dev holds no xtask, ledgers, pin or golden) #909 owns it. The same one-line setup follows there after row 163: the predev→dev move is judged absolute and from predev's own oracle pin (dev holds no xtask, ledgers, pin or golden) #909 lands.