Repository navigation
chore: release v0.6.47 - #647
Merged
Merged
Conversation
…filesearchfailed@nios.net
It watched three workflows and dropped any other ('Unknown workflow name; not notifying'), and its issues claimed a mail to a placeholder address no step sent. It now watches every workflow that can fail on main (release, publish, CodeQL, vet refresh, crates dry-run, cache warm, WinGet besides PR Fast, Tier 2 and the canary), files a labelled issue for an unlisted one instead of dropping it, and mails ultrafastfilesearchfailed@nios.net (the owner's <repo>failed@nios.net convention, derived from the repository name) over Gmail SMTP from the NOTIFY_SMTP_USER account, also when filing the issue failed; without the two secrets it warns on the run instead. The release pipeline's issue text names the real address.
Three recipe messages quoted a name in backticks inside a double-quoted printf, so the shell executed it instead of printing it: the PGO recipe's closing hint ran `just use-local` (a real install of the binary), another ran `build.target-dir`, and `just phase2-ship` ran `main`. The names are now in single quotes. Same defect as the one fixed today in rust-forge-template and iv.
The repository allows merge commits only, and main's merge queue merges with MERGE, but parts of the machinery still carried the squash-era assumptions: - `just ship` rebased the release branch onto origin/main (rewriting its signed commits and flattening any merge on it) and enrolled the release PR with `gh pr merge --auto --squash`, a method flag a queue-governed branch refuses. It now merges origin/main into the release branch and enrolls with `--auto` alone, which is what `just merge` runs; the PR body names release-auto-trigger.yml instead of the retired manual `just release-tag` step. - The commit-signature gate skipped merge commits on the claim that main is linear. A merge made on a branch now reaches main as-is, so it is checked like any other commit. - `just sign-branch` re-signed with a plain rebase, which flattens the merges a branch carries; it now uses --rebase-merges. - Comments that described squash subjects (just merge, commitlint, dependabot auto-merge, the changelog draft filter).
… of opening a PR Opening a pull request is the maintainer's call, never the CI's: every PR is a paid CI round, and a PR opened by GITHUB_TOKEN runs no workflows until someone nudges it (#643 sat with no checks for a week). The run now ends with the refreshed supply-chain diff in its job summary and the files as an artifact; the maintainer applies them with `cargo vet regenerate imports && cargo vet prune` on a working branch, and the job needs contents: read only. Same shape as the rust-forge-template and iv fix.
…in, not a floating nightly `crates-io-publish` installed `dtolnay/rust-toolchain@nightly`, the only unpinned toolchain left in the workflows. `cargo publish` verifies each crate by building it, so a nightly the release was never built with could fail the publish on a new lint or a compiler regression; that is the canary's job to find. The job now runs `rustup show` against the checked-out release tag's rust-toolchain.toml, like every other job in release-plz.yml.
The floating-nightly canary has failed since 2026-11-02 on clippy::unnecessary_lazy_evaluations in uffs-mft: the default-stream size fallback in the full and forensic parsers built a pair of integers inside a closure. It is computed eagerly now, with the reparse-point reasoning kept in one comment. nightly-2026-11-10 adds clippy::ifs_as_logical_ops, which fires on the smart-case flag in uffs-client's argument parser and on the ADS check in uffs-compare-scan-parity; both are boolean expressions now. The ADS check uses `str::get` instead of a byte slice, so a multi-byte character at byte 2 no longer panics, which leaves the file's `clippy::string_slice` expectation unfulfilled, and the simpler parser drops below the cognitive-complexity threshold; both expectations are removed.
`just toolchain-sync` proves a candidate nightly with strict clippy under both feature sets, the Windows xwin clippy and the Linux zigbuild, but never ran rustfmt, so it could accept a pin whose formatting the very next push refuses (the 2026-10-29 bump re-wrapped comments in twenty files and surfaced only at pre-push). After a successful bump it now runs `cargo fmt --all` under the new pin and names the files it changed, so the pin and its formatting land in one change.
… vetted The lockfile takes the newest compatible release of every crate (cc 1.11.1, rmcp 3.9.0, toml 1.2.1, smallvec 1.16.5, itoa 1.0.19, uuid 1.29.2, rustls-pki-types 1.16.0, flate2 1.1.11, crc32fast 1.5.5, wasm-bindgen 0.2.130 and friends, zstd 0.13.4 / zstd-safe 7.4.0, ...), and the workspace requirements are raised to match. Supersedes the weekly vet refresh #643. reqwest stays on 0.12, re-verified today: 0.13.5 is still the latest, still routes system trust through the Android JNI stack, and polars 0.55.2 (still the newest polars) still uses 0.12, so 0.13 would link two TLS stacks. zstd 0.13.4 / zstd-safe 7.4.0 backport the fixes for RUSTSEC-2026-0391, -0398 and -0403 to the line polars-arrow uses, so the three documented ignores in deny.toml are gone: cargo deny now reports them as not encountered. zstd 0.13.4 is relicensed MIT -> BSD-3-Clause, which the license policy allows. Vetting, in order: the imports were regenerated first, which retires four exemptions now covered upstream (futures, futures-channel, futures-executor, futures-io). Twelve deltas were left. Seven repeat reviews the owner recorded in skyllc-ai/docenta today and were re-read against the same diff (crc32fast, flate2, itoa, log, rmcp, rmcp-macros, smallvec). bit-vec, const-oid, rustls-pki-types, zstd and zstd-safe were reviewed here, zstd-safe with focus on its FFI wrappers. No exemption added or bumped, no trust entry added. Vet-Reviewed-Diff: bit-vec@0.10.1->0.10.2 Vet-Reviewed-Diff: const-oid@0.10.2->0.10.3 Vet-Reviewed-Diff: rustls-pki-types@1.15.1->1.16.0 Vet-Reviewed-Diff: zstd@0.13.3->0.13.4 Vet-Reviewed-Diff: zstd-safe@7.3.0->7.4.0 Vet-Reviewed-Diff: crc32fast@1.5.3->1.5.5 Vet-Reviewed-Diff: flate2@1.1.10->1.1.11 Vet-Reviewed-Diff: itoa@1.0.18->1.0.19 Vet-Reviewed-Diff: log@0.4.34->0.4.35 Vet-Reviewed-Diff: rmcp@3.8.0->3.9.0 Vet-Reviewed-Diff: rmcp-macros@3.8.0->3.9.0 Vet-Reviewed-Diff: smallvec@1.16.4->1.16.5
codeql-action v4.39.1 -> v4.39.3 (init and analyze in lockstep), release-plz/action v0.5.145 -> v0.5.148 (release-plz 0.4.1 -> 0.4.3, maintenance releases), softprops/action-gh-release -> v3.0.4, taiki-e/install-action -> v2.90.3 (its manifest serves cargo-vet 0.10.3). Each SHA was resolved from its release tag. Comments that named only a major (v3, v7, v9) now name the exact release the SHA is, and release-plz.yml no longer claims its pin is the v0.5.128 tag. Supersedes dependabot #645.
…te accepts `just toolchain-sync` took nightly-2026-10-29 -> nightly-2026-11-10 on its first candidate: strict clippy under --all-features and --no-default-features, the Windows xwin clippy and the Linux zigbuild all pass, every rust-toolchain.toml component installs, and the new rustfmt reformats nothing. The lint fixes it needed (#641 and the new clippy::ifs_as_logical_ops) landed in the commit before.
…eeps it in sync CITATION.cff still said version 0.5.120 (2026-06-09): it was to be bumped by the version tooling R5 retired, and nothing took over, so every release since has been cited as 0.5.120. The ship pipeline now rewrites its top-level `version` and `date-released` in the release commit, right after the changelog roll and with the same date; the rest of the file is kept byte for byte. The file is set to the current release, 0.6.46 of 2026-10-29, here.
Workspace version 0.6.46 -> 0.6.47 (cargo set-version --bump patch, as `just ship` does), the changelog entry for this release, and CITATION.cff set to the new version and date.
This was referenced Nov 10, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
One batch, one CI run: everything since v0.6.46, with the notifier branch (#646) merged in as a real merge. Supersedes Dependabot #645 and the bot vet refresh #643, which close once this lands.
Nightly canary (#641)
fix(lints): the canary failed since 2026-11-02 onclippy::unnecessary_lazy_evaluationsin the uffs-mft full and forensic parsers (default-stream size fallback); computed eagerly now. nightly-2026-11-10 addsclippy::ifs_as_logical_ops(smart-case flag in uffs-client, ADS check in uffs-compare-scan-parity); both are boolean expressions, and the ADS check usesstr::get, so a multi-byte character at byte 2 no longer panics. Two expectations that went unfulfilled are removed.Toolchain
build(toolchain): nightly-2026-10-29 -> nightly-2026-11-10 viajust toolchain-sync(strict clippy both feature sets, Windows xwin clippy, Linux zigbuild, components, rustfmt changes nothing).fix(just):toolchain-syncnow runscargo fmt --allunder the pin it chose and names the files it changed.Dependencies and vetting
deny.tomlignores are gone. zstd 0.13.4 is relicensed MIT -> BSD-3-Clause (allowed).Merge commits end to end
fix(merge):just shiprebased the release branch onto origin/main and enrolled it with--auto --squash, a method flag the queue refuses. It now merges origin/main in and enrolls with--auto(whatjust mergeruns). The commit-signature gate checks merge commits too;just sign-branchkeeps merges (--rebase-merges); squash-era comments updated.fix(just): three recipe messages ran the names they quoted in backticks (one ranjust use-local).CI and release
ci(vet): the weekly cargo-vet refresh reports the diff (job summary + artifact) instead of opening a PR;contents: readonly.ci(release): the crates.io publish job installs the pinned toolchain (rustup show) instead ofdtolnay/rust-toolchain@nightly.ci(notify)(ci(notify): every failed workflow files its issue and mails <repo>failed@nios.net #646): every failed workflow files its issue and mails.fix(release): CITATION.cff was stuck at 0.5.120; it now names the release andjust shipkeeps it in sync.Failed runs of the last 10 days
ci(deps): ...) passes commitlint.Version: 0.6.47.
Test plan
just toolchain-sync(host clippy both feature sets, Windows xwin clippy, Linux zigbuild);cargo vet check --locked;cargo deny check; actionlint.Closes #641.