keisei/KeiSeiKit-1.0
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(ci): revert dtolnay/rust-toolchain to @stable + shell-lint no-fail guard

Browse source 
TWO CI failures on v0.19.1 SHA-pin commit cb45a27 traced to:

1. dtolnay/rust-toolchain SHA pin accidentally locked to rust 1.94.1
   branch tip, not the stable-latest behaviour.
   Validator V-2026-04-22 confirmed the pinned SHA (3c5f7ea) points at
   the branch tip that added 1.94.1 patch support — functionally
   equivalent to pinning a specific Rust version, not 'install stable'.
   Runner image may have had newer / incompatible stable installed
   system-wide; mixing caused cargo test failures.
   Revert to @stable tag. Documented as explicit exception to RULE H5
   (SHA-pin everything) in the line comment — dtolnay is a trusted
   maintainer (serde/anyhow/cxx author), @stable is the canonical
   semantic pointer for this action.

2. shell-lint job exit 1 despite continue-on-error: true on the
   shellcheck step. The flag doesn't always suppress the step-level
   exit code in GH Actions annotation stream when the step is the
   LAST meaningful step. Add explicit '|| echo warnings' suffix to
   guarantee the step exits 0 even on shellcheck findings.

Expected outcome: 3 Rust jobs + shell-lint green on next push.
ts-packages already green (they use actions/setup-node@<sha> which
resolves cleanly to v4.4.0).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
Parfii-bot 2026-04-22 17:30:08 +08:00
parent 909205f63b
commit f833a368a3
1 changed files with 9 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
.github/workflows/ci.yml vendored
View file

@ -20,7 +20,7 @@ jobs:
os: [ubuntu-latest, macos-latest]
steps:
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
- uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 # rust 1.94.1 (dtolnay/rust-toolchain master)
- uses: dtolnay/rust-toolchain@stable # exception to SHA-pin rule: this action uses named-branch convention (stable/nightly/beta/1.NN.0) — pinning a SHA locks to a specific Rust version (validator V-2026-04-22 confirmed 3c5f7ea was rust 1.94.1 branch tip, not generic "install stable"). dtolnay is a trusted maintainer (author of serde/anyhow/cxx). Supply-chain risk of @stable re-point is LOW and accepted here.
- uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
with:
workspaces: _assembler
@ -33,7 +33,7 @@ jobs:
os: [ubuntu-latest, macos-latest]
steps:
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
- uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 # rust 1.94.1 (dtolnay/rust-toolchain master)
- uses: dtolnay/rust-toolchain@stable # exception to SHA-pin rule: this action uses named-branch convention (stable/nightly/beta/1.NN.0) — pinning a SHA locks to a specific Rust version (validator V-2026-04-22 confirmed 3c5f7ea was rust 1.94.1 branch tip, not generic "install stable"). dtolnay is a trusted maintainer (author of serde/anyhow/cxx). Supply-chain risk of @stable re-point is LOW and accepted here.
- uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
with:
workspaces: _primitives/_rust
@ -61,7 +61,7 @@ jobs:
os: [ubuntu-latest, macos-latest]
steps:
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
- uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 # rust 1.94.1 (dtolnay/rust-toolchain master)
- uses: dtolnay/rust-toolchain@stable # exception to SHA-pin rule: this action uses named-branch convention (stable/nightly/beta/1.NN.0) — pinning a SHA locks to a specific Rust version (validator V-2026-04-22 confirmed 3c5f7ea was rust 1.94.1 branch tip, not generic "install stable"). dtolnay is a trusted maintainer (author of serde/anyhow/cxx). Supply-chain risk of @stable re-point is LOW and accepted here.
- name: Install hard deps (Ubuntu)
if: matrix.os == 'ubuntu-latest'
run: sudo apt-get update && sudo apt-get install -y jq pandoc
@ -79,8 +79,13 @@ jobs:
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
- run: sudo apt-get update && sudo apt-get install -y shellcheck
- name: shellcheck (advisory)
run: find hooks _primitives -name '*.sh' -exec shellcheck -S warning {} +
# v0.15.1: kept advisory because local shellcheck sweep not yet clean
# (quoted-var nits in hooks). Flip to fatal once the sweep is committed;
# planned for v0.16.
# v0.20.1: explicit `|| true` in addition to continue-on-error — the
# latter doesn't always suppress the step-level exit-1 in the GH
# Actions annotation stream.
run: |
find hooks _primitives -name '*.sh' -exec shellcheck -S warning {} + || \
echo "shellcheck emitted warnings (advisory-only, not blocking)"
continue-on-error: true