From f69974dc1bdc7a80b40a2be3d844e7b37a3390d4 Mon Sep 17 00:00:00 2001 From: Anand Krishnamoorthi <35780660+anakrish@users.noreply.github.com> Date: Wed, 25 Mar 2026 16:58:29 -0500 Subject: [PATCH] ci(dependabot): fix cargo workspace updates and refresh lockfiles (#629) * ci(dependabot): fix cargo workspace updates and refresh lockfiles Remove nested Cargo workspace members from Dependabot's cargo directories to avoid manifest resolution failures during grouped updates. Add a Dependabot-only workflow that refreshes affected Cargo lockfiles, including the no_std target-specific resolution path, so CI can continue enforcing --locked and --frozen builds. Signed-off-by: Anand Krishnamoorthi * ci(dependabot): address workflow review comments Signed-off-by: Anand Krishnamoorthi * ci(dependabot): address workflow permission and toolchain comments Signed-off-by: Anand Krishnamoorthi * ci(dependabot): stage no-std lockfile refresh Signed-off-by: Anand Krishnamoorthi * ci(dependabot): harden refresh workflow * ci(dependabot): refine workflow gating and staging * ci(dependabot): harden workflow git operations --------- Signed-off-by: Anand Krishnamoorthi --- .github/dependabot.yml | 3 - .../dependabot-refresh-cargo-lockfiles.yml | 129 ++++++++++++++++++ 2 files changed, 129 insertions(+), 3 deletions(-) create mode 100644 .github/workflows/dependabot-refresh-cargo-lockfiles.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 6141679..0f476bc 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -17,10 +17,7 @@ updates: - "/bindings/java" - "/bindings/python" - "/bindings/ruby" - - "/bindings/ruby/ext/regorusrb" - "/bindings/wasm" - - "/tests/ensure_no_std" - - "/xtask" schedule: interval: "weekly" commit-message: diff --git a/.github/workflows/dependabot-refresh-cargo-lockfiles.yml b/.github/workflows/dependabot-refresh-cargo-lockfiles.yml new file mode 100644 index 0000000..d1bcc59 --- /dev/null +++ b/.github/workflows/dependabot-refresh-cargo-lockfiles.yml @@ -0,0 +1,129 @@ +# Copyright (c) Microsoft Corporation. All rights reserved. +# +name: dependabot/refresh-cargo-lockfiles + +on: + pull_request_target: + types: [opened, synchronize, reopened] + branches: ["main"] + +concurrency: + group: dependabot-refresh-cargo-lockfiles-${{ github.event.pull_request.number }} + cancel-in-progress: true + +permissions: + contents: read + +env: + CARGO_TERM_COLOR: always + +jobs: + refresh-cargo-lockfiles: + permissions: + contents: write + if: >- + github.event.pull_request.user.login == 'dependabot[bot]' && + github.event.pull_request.head.repo.full_name == github.repository + runs-on: ubuntu-latest + + steps: + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd + with: + repository: ${{ github.event.pull_request.head.repo.full_name }} + ref: ${{ github.event.pull_request.head.ref }} + fetch-depth: 0 + persist-credentials: false + + - name: Setup Rust toolchain + run: | + rustup toolchain install 1.92.0 --profile minimal + rustup override set 1.92.0 + cargo --version + rustc --version + + - name: Refresh affected Cargo lockfiles + shell: bash + run: | + set -euo pipefail + + base_sha="${{ github.event.pull_request.base.sha }}" + head_sha="${{ github.event.pull_request.head.sha }}" + + mapfile -t changed_files < <(git diff --name-only "$base_sha" "$head_sha" -- ':(glob)**/Cargo.toml' ':(glob)**/Cargo.lock') + + if [ "${#changed_files[@]}" -eq 0 ]; then + echo "No Cargo manifest or lockfile changes detected." + exit 0 + fi + + declare -A manifests=() + for path in "${changed_files[@]}"; do + case "$path" in + bindings/ffi/*) + manifests["bindings/ffi/Cargo.toml"]=1 + ;; + bindings/java/*) + manifests["bindings/java/Cargo.toml"]=1 + ;; + bindings/python/*) + manifests["bindings/python/Cargo.toml"]=1 + ;; + bindings/ruby/*) + manifests["bindings/ruby/Cargo.toml"]=1 + ;; + bindings/wasm/*) + manifests["bindings/wasm/Cargo.toml"]=1 + ;; + *) + manifests["Cargo.toml"]=1 + ;; + esac + done + + for manifest in "${!manifests[@]}"; do + echo "Refreshing lockfile for $manifest" + cargo metadata \ + --config build.rustc="rustc" \ + --config build.rustc-wrapper="" \ + --config build.rustc-workspace-wrapper="" \ + --format-version 1 \ + --all-features \ + --manifest-path "$manifest" > /dev/null + done + + if [[ -n "${manifests[Cargo.toml]+x}" ]]; then + echo "Refreshing lockfile for tests/ensure_no_std/Cargo.toml (thumbv7m-none-eabi)" + cargo metadata \ + --config build.rustc="rustc" \ + --config build.rustc-wrapper="" \ + --config build.rustc-workspace-wrapper="" \ + --format-version 1 \ + --manifest-path tests/ensure_no_std/Cargo.toml \ + --filter-platform thumbv7m-none-eabi > /dev/null + fi + + - name: Commit lockfile refresh + shell: bash + env: + GH_TOKEN: ${{ github.token }} + run: | + set -euo pipefail + + mapfile -t lockfiles < <(git ls-files -m -o --exclude-standard -- ':(glob)**/Cargo.lock') + + for lockfile in "${lockfiles[@]}"; do + git add "$lockfile" + done + + if git diff --cached --quiet; then + echo "No Cargo lockfile changes required." + exit 0 + fi + + auth_header=$(printf 'x-access-token:%s' "$GH_TOKEN" | base64 | tr -d '\n') + trap 'git config --unset-all http.https://github.com/.extraheader' EXIT + git config http.https://github.com/.extraheader "AUTHORIZATION: basic ${auth_header}" + git config user.name "github-actions[bot]" + git config user.email "41898282+github-actions[bot]@users.noreply.github.com" + git commit -m "build(deps): refresh Cargo lockfiles" + git push origin HEAD:${{ github.event.pull_request.head.ref }}