Skip to content

Conversation

@onihilist
Copy link
Contributor

No description provided.

@onihilist
Copy link
Contributor Author

Force push for removing an old commit from another PR

@onihilist
Copy link
Contributor Author

currently blocking error in the CI: error: linking with clang

@kanarus
Copy link
Member

kanarus commented Dec 8, 2025

the rustc_parse's panic with the latest nightly ( nightly-x86_64-unknown-linux-gnu unchanged - rustc 1.94.0-nightly (ba2142a19 2025-12-07) ) reproduced on my PC

@kanarus
Copy link
Member

kanarus commented Dec 8, 2025

this seems caused by rustfmt (cargo fmt)

@kanarus
Copy link
Member

kanarus commented Dec 8, 2025

seems same problem as rust-lang/rustfmt#6739

@kanarus
Copy link
Member

kanarus commented Dec 8, 2025

rust-lang/rust#149692

@kanarus
Copy link
Member

kanarus commented Dec 8, 2025

@kanarus
Copy link
Member

kanarus commented Dec 8, 2025

@onihilist for now, could you update the other .ymls in .github as well?

@onihilist
Copy link
Contributor Author

@onihilist for now, could you update the other .ymls in .github as well?

@kanarus Yup I'm doing that right now !

@onihilist
Copy link
Contributor Author

onihilist commented Dec 8, 2025

Ok in commit 46463a3, I can't change rust-lang/crates-io-auth-action@v1 to rust-lang/crates-io-auth-action@b7e9a28eded4986ec6b1fa40eeee8f8f165559ec because : Retrieve a temporary crates.io access token using trusted publishing.

EDIT:

Same for hmarr/auto-approve-action@v4

@kanarus
Copy link
Member

kanarus commented Dec 8, 2025

I can't change rust-lang/crates-io-auth-action@v1 to rust-lang/crates-io-auth-action@b7e9a28eded4986ec6b1fa40eeee8f8f165559ec because : Retrieve a temporary crates.io access token using trusted publishing.

EDIT:

Same for hmarr/auto-approve-action@v4

Technically, pinning to a commit hash does not affect functionality, even for Trusted Publishing. It ensures the exact same code is executed but significantly improves security against supply chain attacks by making the dependency immutable.


edit:

pinning to a commit hash does not affect functionality

In other words, the way to specify the action's version (tag vs commit hash) does not affect the internal OIDC authentication logic (Trusted Publishing) or the auto-approving logic (GitHub API).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants