[dependabot]

Bumps dtolnay/rust-toolchain from 7e38f4b43b4db5c8dd498af069a4f6196df1d067 to e2a55d2ffb04f378e9626c28d38b36d230d1e12f.

Commits

• e2a55d2 Merge pull request #187 from dtolnay/pwn
• 6af9a09 Unify flags[@] and downgrade[@]
• 83d0610 Safely handle action inputs
• See full diff in compare view

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge.

What this changes

This PR updates eight dtolnay/rust-toolchain pins across CI and release workflows to an upstream revision that handles action inputs safely.

Example: The minimum-version CI job installs Rust 1.88.0.

• Before: The workflow runs action revision 7e38f4b43b4db5c8dd498af069a4f6196df1d067.
• After: The workflow runs revision e2a55d2ffb04f378e9626c28d38b36d230d1e12f with the same Rust 1.88.0 input.

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A useful, narrowly scoped dependency refresh with no concrete findings and successful installer execution; the full current-head CI run is unfinished.
Proof confidence	🌊 off-meta tidepool	Not applicable: This Dependabot workflow dependency PR is outside the ordinary contributor runtime-proof gate; hosted jobs directly executed the updated installer successfully across Linux, macOS, and Windows.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Product

Kind: Maintenance · Worth it: Yes · Fix scope: Complete
User problem: CI and release jobs use an older Rust installer action with less safe handling of action inputs.
Reason: The small, consistent dependency refresh adopts upstream input hardening without changing OCM defaults, public interfaces, or release safeguards.

Merge readiness

✅ Ready for maintainer review

Keep this PR open: main still uses the previous action revision, and this focused update preserves existing toolchain and release behavior. No actionable defect was found; some current-head CI jobs remain in progress.

Priority: P3
Reviewed head: 574278212f457a599a5f5c5472a6087171aef74b

Before merge

None.

Findings

None.

Agent review details

How this fits together

GitHub workflows pass fixed Rust versions and release target triples to the toolchain installer, then use the installed compiler for checks, builds, and release verification.

flowchart TD
  A[GitHub workflow event] --> B[CI or release job]
  B --> C[Pinned toolchain action]
  C --> D[Rustup installation]
  D --> E[Cargo checks and builds]
  E --> F[Existing release verification]

Loading

Technical review

Best possible solution:

Land the consistent action-pin update through the existing required CI gates.

Do we have a high-confidence way to reproduce the issue?

This is dependency maintenance rather than a reported OCM runtime failure; source comparison verifies the upstream input-handling change.

Is this the best way to solve the issue?

Updating every existing pin together is appropriately scoped and retains the previous installer's retry behavior.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 914e2bef17fd.

Provenance checked

• Rust installer pins across CI and release workflows keeps the original intent (b5a7047: The previous update added narrowly scoped retries for recognized transient official release-server checksum failures while preserving checksum enforcement.)

Testing

Proof path: none.

Security

None.

Evidence

What I checked:

• Verified introduction and main comparison: The pinned base-to-head diff contains only eight action SHA substitutions in four workflows; main retains the previous revision, with toolchain versions, target inputs, permissions, and release gates unchanged. (.github/workflows/ci.yml:23, 574278212f45)
• Executed dependency and upstream security inspection: The workflows execute this dependency directly. Its complete upstream comparison changes only action.yml, moving toolchain inputs into quoted environment variables and target/component arguments into arrays while preserving the recognized checksum-failure retry. (action.yml:84, e2a55d2ffb04)
• Original installer intent: chore(deps): refresh libc and the Rust installer action #311 introduced the previous pin to tolerate narrowly recognized transient checksum failures without relaxing verification; the new upstream action retains that behavior. (.github/workflows/ci.yml:23, b5a704758d15)
• Current-head workflow execution: Run https://github.com/openclaw/ocm/actions/runs/38514588486 shows successful updated-action steps on Linux, macOS, and Windows; Format and Rust 1.88 minimum completed successfully, while the Linux/macOS test and Windows jobs were still running. (.github/workflows/ci.yml:23, 574278212f45)
• Maintainer discussion: vincentkoc requested rebases and re-review, and explained the earlier macOS DNS failure in chore(deps): bump dtolnay/rust-toolchain from 7e38f4b43b4db5c8dd498af069a4f6196df1d067 to e2a55d2ffb04f378e9626c28d38b36d230d1e12f #356 (comment); that historical failure is not attributed to this diff. (574278212f45)
• Repository policy and inspection limits: Read the complete root AGENTS.md and CONTRIBUTING.md; no nested AGENTS.md or maintainer-notes directory exists. The checkout remains clean. Local older-object inspection encountered a missing blob and the earlier reviewed SHA was unavailable, so no historical-head equivalence is claimed. (AGENTS.md:1, 574278212f45)

Likely related people:

• Vincent Koc: Raw commit ca0d0ed adds .github/workflows/publish-npm.yml:34 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: ca0d0ed95413; files: .github/workflows/publish-npm.yml)
• Shakker: Raw commit 97aabe7 adds .github/workflows/ci.yml:14 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 97aabe715c38; files: .github/workflows/ci.yml)

Labels

Label changes:

No label changes.

Label justifications:

• P3: A focused workflow dependency refresh preserves the existing supported toolchains and release contract.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

History

Review history (4 earlier review cycles)

• reviewed 2026-10-13T19:51:41.608Z sha 7a7531c :: blocked before merge. :: none
• reviewed 2026-10-14T02:53:03.596Z sha 7a7531c :: blocked before merge. :: none
• reviewed 2026-10-14T04:47:11.966Z sha 9447bbe :: needs changes before merge. :: none
• reviewed 2026-10-14T05:00:55.639Z sha 9447bbe :: needs maintainer review before merge. :: none

Reviewed October 14, 2026, 1:06 AM ET / 05:06 UTC (Revision 5).

[vincentkoc]

@dependabot rebase

[vincentkoc]

@clawsweeper re-review

[clawsweeper]

🦞👀
Exact review queued.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/38514510998
• Updated: 2026-10-14T05:02:42.799Z

[vincentkoc]

Inspected the current-head macOS failure: the private-config setup step failed before compilation because index.crates.io DNS resolution failed while loading base64. This is unrelated to the action change. The Linux suite and all other checks passed on 9447bbe; the failed macOS job has been rerun once. The older service-test port-collision failure is already repaired on main by #357 and included in this rebased head.

[vincentkoc]

@dependabot rebase

[vincentkoc]

@clawsweeper re-review

[clawsweeper]

🦞👀
Exact review queued.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/38514996554
• Updated: 2026-10-14T05:08:10.565Z