From ce235356bc3c794fc58ab1d401b2e8e853a1d20a Mon Sep 17 00:00:00 2001
From: Anand Krishnamoorthi <35780660+anakrish@users.noreply.github.com>
Date: Mon, 13 Apr 2026 17:55:44 -0500
Subject: [PATCH] build: fix rand advisory and harden python CI caching (#675)

Update Cargo.lock to move rand to 0.10.1 so cargo-deny stops failing on RUSTSEC-2026-0097.

Also tighten the Python workflow cache boundaries by keying rust-cache to pinned runner images. The workflow now keeps Ubuntu 22.04, Ubuntu 24.04, and Windows 2022 caches separate, which avoids reusing host build artifacts across runner image changes. That is the class of issue behind the intermittent GLIBC mismatch seen in CI.
---
 .github/workflows/test-python.yml | 13 ++++++++-----
 Cargo.lock                        |  4 ++--
 2 files changed, 10 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/test-python.yml b/.github/workflows/test-python.yml
index 1f01a4e..054e819 100644
--- a/.github/workflows/test-python.yml
+++ b/.github/workflows/test-python.yml
@@ -18,7 +18,7 @@ jobs:
         host:
           - name: ubuntu-22.04
             target: x86_64-unknown-linux-gnu
-          - name: windows-latest
+          - name: windows-2022
             target: x86_64-pc-windows-msvc
     runs-on: ${{ matrix.host.name }}
     steps:
@@ -32,7 +32,7 @@ jobs:
       - name: Cache cargo
         uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
         with:
-          shared-key: ${{ runner.os }}-regorus
+          shared-key: ${{ runner.os }}-${{ matrix.host.name }}-regorus
       - name: Fetch dependencies
         run: cargo fetch --locked
 
@@ -60,9 +60,12 @@ jobs:
     needs: build
     strategy:
       matrix:
-        host: [ubuntu-24.04, ubuntu-22.04, windows-latest]
+        host:
+          - name: ubuntu-24.04
+          - name: ubuntu-22.04
+          - name: windows-2022
         python-version: ["3.10", "3.11", "3.12", "3.13"]
-    runs-on: ${{ matrix.host }}
+    runs-on: ${{ matrix.host.name }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -72,7 +75,7 @@ jobs:
       - name: Cache cargo
         uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
         with:
-          shared-key: ${{ runner.os }}-regorus
+          shared-key: ${{ runner.os }}-${{ matrix.host.name }}-regorus
       - name: Fetch dependencies
         run: cargo fetch --locked
 
diff --git a/Cargo.lock b/Cargo.lock
index 7c946b4..2819fb7 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1239,9 +1239,9 @@ checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
 
 [[package]]
 name = "rand"
-version = "0.10.0"
+version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bc266eb313df6c5c09c1c7b1fbe2510961e5bcd3add930c1e31f7ed9da0feff8"
+checksum = "d2e8e8bcc7961af1fdac401278c6a831614941f6164ee3bf4ce61b7edb162207"
 dependencies = [
  "chacha20",
  "getrandom 0.4.2",