Repository navigation
Repin dtolnay/rust-toolchain to the current v1 - #1199
Merged
Merged
Conversation
The upstream `v1` tag of `dtolnay/rust-toolchain` moved to `e2a55d2ffb04f378e9626c28d38b36d230d1e12f` when dtolnay/rust-toolchain#187 merged. The pin in `update_sandbox.yml` still pointed at the previous `v1` commit, so its `# v1` comment no longer matched and the `Lint / Zizmor Online` check failed on every pull request with `ref-version-mismatch`. This repins to the current `v1` commit and keeps the comment, as the earlier repins of this pin did. Upstream moved every input and the parsed toolchain out of inline expressions in `run:` scripts and into environment variables. For this call site, `toolchain: stable` with no targets or components, the rustup commands are unchanged.
epompeii
marked this pull request as ready for review
October 11, 2026 00:35
epompeii
added a commit
that referenced
this pull request
Oct 16, 2026
## Problem `Lint / Zizmor Online` failed on #1251 (run https://github.com/bencherdev/bencher/actions/runs/38846843953, job https://github.com/bencherdev/bencher/actions/runs/38846843953/job/116799199507) with one medium finding, exit 13: ``` update_sandbox.yml:18: action's hash pin has mismatched or missing version comment: points to commit 683b588c487a ``` Line 18 is `dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f # v1`, pinned by #1199. The upstream `v1` tag moved to `683b588c487a69d01f6c6ddf40f036ff682cc2c8` on 2026-10-16. `devel` carries the same pin, so the job is red on every run since. The job is `continue-on-error: true`, so it does not block a merge. ## Change Repin `update_sandbox.yml` to the commit `v1` points at today and keep the `# v1` comment, as #1199 did. The hash was resolved from the GitHub refs API (`v1` is a lightweight tag on that commit). No other workflow or composite action uses this action. ## Upstream range `e2a55d2f...683b588c` is one commit, "Add 1.99.1 patch release", which adds `1.99.1` to the patch release list in `scripts/update-revs.sh`. `action.yml` is unchanged, so this call site (`toolchain: stable`) runs exactly the same steps. ## Other moving refs Every other pin whose comment names a moving ref still matches it today: `rui314/setup-mold@339e96b4 # v1` (14 sites), `dawidd6/action-download-artifact@b6e2e706 # v21` (2 sites), and `superfly/flyctl-actions/setup-flyctl@ed8efb33 # master` (3 sites, the current `master` head). The online pass below proves it. ## Verification zizmor 1.25.2, the version CI pins, from the same digest-pinned image `zizmor-action` runs (`ghcr.io/zizmorcore/zizmor:1.25.2@sha256:14ea7f5c...`), with the action's arguments (`--persona=regular --format=github`, plus `--no-online-audits` for the offline job): | Tree | Offline | Online | | --- | --- | --- | | `devel` | exit 0 | exit 13, the one `ref-version-mismatch` finding above | | this branch | exit 0 | exit 0, no findings | CI on this pull request is the final check.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Lint / Zizmor Onlinefails on every pull request (for example run 37884500334 on #1153) with one medium finding, exit 13:The upstream
v1tag ofdtolnay/rust-toolchainmoved toe2a55d2ffb04f378e9626c28d38b36d230d1e12fon 2026-10-09 when dtolnay/rust-toolchain#187 merged. The job iscontinue-on-error: true, so it does not block a merge, but it is red on every open pull request.Change
Repin
update_sandbox.ymlto the commitv1points at today and keep the# v1comment. This follows #987, #1045, and #1088, which trackedv1for this same pin, andv1is the only tag upstream publishes. The hash was resolved from the GitHub refs API.Upstream range
7e38f4b4...e2a55d2fis three commits, all inaction.yml, fixing the command injection reported in dtolnay/rust-toolchain#179:${{ }}expressions inrun:scripts and intoenv:variables, quoted at each use.toolchainoutput is written with a heredoc delimiter instead ofkey=value.--target,--component, and--allow-downgradestrings is folded into the install step as a bash array.This call site passes only
toolchain: stable, no targets or components, so it was never exposed, and it still runsrustup toolchain install stable --profile minimal --no-self-update --force-non-hostfollowed byrustup default stable --force-non-host. No other workflow or composite action uses this action.Other moving refs
Every other pin whose comment names a moving ref still matches it today:
rui314/setup-mold@10ca16bf # v1(14 sites),dawidd6/action-download-artifact@b6e2e706 # v21(2 sites), andsuperfly/flyctl-actions/setup-flyctl@ed8efb33 # master(3 sites, the currentmasterhead). Nothing else needs a change.Verification
zizmor 1.25.2, the version CI pins, from the same digest-pinned image
zizmor-actionruns (ghcr.io/zizmorcore/zizmor:1.25.2@sha256:14ea7f5c...), with the action's arguments (--persona=regular --format=github, plus--no-online-auditsfor the offline job):devel1 medium(the finding above)No findings to reportCI on this pull request is the final check.