From 551119c761cb9505b81cc29ed86917cb1d99dc52 Mon Sep 17 00:00:00 2001 From: Martyn Date: Tue, 3 Nov 2026 09:03:48 +0000 Subject: [PATCH 1/2] Adds exception so dependabot ignores rust version for MSRV test --- .github/dependabot.yml | 4 ++++ .github/workflows/actions.yml | 1 + TESTING.md | 8 +++++--- 3 files changed, 10 insertions(+), 3 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 7f56320..48e72cd 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -12,3 +12,7 @@ updates: schedule: interval: weekly open-pull-requests-limit: 5 + ignore: + # The versioned ref tests our MSRV; @stable jobs track the latest compiler. + # Raise the MSRV deliberately alongside Cargo.toml's rust-version. + - dependency-name: dtolnay/rust-toolchain diff --git a/.github/workflows/actions.yml b/.github/workflows/actions.yml index f3e797e..a937edb 100644 --- a/.github/workflows/actions.yml +++ b/.github/workflows/actions.yml @@ -78,6 +78,7 @@ jobs: steps: - uses: actions/checkout@v7 + # Keep pinned to Cargo.toml's rust-version; rust-stable tests the latest Rust. - uses: dtolnay/rust-toolchain@1.88.0 - name: Build & Test diff --git a/TESTING.md b/TESTING.md index ea9aadf..a6883d0 100644 --- a/TESTING.md +++ b/TESTING.md @@ -89,9 +89,11 @@ their normal package manager as described above. ## Platform coverage The minimum supported Rust version is **1.88.0**, declared as `rust-version = "1.88"` -in `Cargo.toml`. CI runs the Rust build and tests on Linux -and Windows, checks Rust 1.88.0 on Linux, and runs the Clevis compatibility tests -in a separate Linux job. +in `Cargo.toml`. CI runs the Rust build and tests on the latest stable compiler +on Linux and Windows, checks Rust 1.88.0 on Linux, and runs the Clevis compatibility +tests in a separate Linux job. The stable jobs follow new Rust releases +automatically. Dependabot ignores `dtolnay/rust-toolchain` updates so the MSRV job +stays pinned; raise it deliberately alongside `Cargo.toml`'s `rust-version`. Other Unix platforms have no CI coverage. See [key storage and rotation](KEY_STORAGE.md) for platform permission and crash-durability differences. From b8cd3e70e90228778207bacc5f0db67a1ee8d2ba Mon Sep 17 00:00:00 2001 From: Martyn Date: Tue, 3 Nov 2026 09:20:05 +0000 Subject: [PATCH 2/2] Fixes duplicated CI jobs for Pull Requests --- .github/workflows/actions.yml | 5 ++++- .github/workflows/advisories.yml | 1 + .github/workflows/fuzz.yml | 1 + TESTING.md | 7 ++++--- 4 files changed, 10 insertions(+), 4 deletions(-) diff --git a/.github/workflows/actions.yml b/.github/workflows/actions.yml index a937edb..d85ecc1 100644 --- a/.github/workflows/actions.yml +++ b/.github/workflows/actions.yml @@ -1,6 +1,9 @@ name: Build and Run -on: [push, pull_request] +on: + push: + branches: [main] + pull_request: permissions: contents: read diff --git a/.github/workflows/advisories.yml b/.github/workflows/advisories.yml index 6aa1db6..93585ba 100644 --- a/.github/workflows/advisories.yml +++ b/.github/workflows/advisories.yml @@ -2,6 +2,7 @@ name: Dependency advisories on: push: + branches: [main] pull_request: schedule: - cron: '23 6 * * *' diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml index 7e15833..f59426b 100644 --- a/.github/workflows/fuzz.yml +++ b/.github/workflows/fuzz.yml @@ -2,6 +2,7 @@ name: Bounded fuzzing on: push: + branches: [main] pull_request: schedule: - cron: '41 6 * * 1' diff --git a/TESTING.md b/TESTING.md index a6883d0..29e5ffd 100644 --- a/TESTING.md +++ b/TESTING.md @@ -100,13 +100,14 @@ for platform permission and crash-durability differences. ## Release checks and fuzzing -CI requires formatting, strict Clippy, compilation, release builds, tests and +CI runs on pull requests and pushes to `main`, avoiding duplicate runs for PR +branch pushes. It requires formatting, strict Clippy, compilation, release builds, tests and Rust 1.88.0 checks, retaining Linux, Windows and Clevis jobs. The assurance job checks the combined platform reports; a local Linux run alone cannot establish Windows behavior. Repository maintainers must select these jobs as required status checks in GitHub branch protection to enforce them before merging. -Dependency advisories are checked on pushes, pull requests and a daily schedule +Dependency advisories are checked on pushes to `main`, pull requests and a daily schedule with a freshly fetched RustSec database. Both the library and fuzz lockfiles are scanned, and warnings fail the check. Dependabot monitors Cargo dependencies (including fuzz tooling) and GitHub Actions weekly. To run the advisory checks: @@ -118,7 +119,7 @@ cargo audit --file fuzz/Cargo.lock --deny warnings ``` Two bounded, seeded fuzz targets exercise recovery request parsing and JWK -conversion on pull requests, pushes and weekly runs. They run on nightly Rust +conversion on pull requests, pushes to `main` and weekly runs. They run on nightly Rust with AddressSanitizer, separately from the library's stable/MSRV builds. See [fuzz/README.md](fuzz/README.md) for commands, resource bounds, seed provenance and crash reproduction. A bounded run is a regression check, not exhaustive