From 5a9aa62d4fbfb1a83f055dc9c6d64099b84346ab Mon Sep 17 00:00:00 2001 From: grandizzy <38490174+grandizzy@users.noreply.github.com> Date: Fri, 18 Sep 2026 10:00:47 +0000 Subject: [PATCH 1/5] chore(ci): route package installs through Aegis Co-authored-by: Derek Cofausper <256792747+decofe@users.noreply.github.com> --- .github/workflows/bench.yml | 9 +++++-- .github/workflows/ci.yml | 47 +++++++++++++++++++++++++++++++++--- .github/workflows/no_std.yml | 3 +++ 3 files changed, 54 insertions(+), 5 deletions(-) diff --git a/.github/workflows/bench.yml b/.github/workflows/bench.yml index 528cb5b..9d0ccf0 100644 --- a/.github/workflows/bench.yml +++ b/.github/workflows/bench.yml @@ -17,8 +17,11 @@ jobs: codspeed: runs-on: ubuntu-latest permissions: + id-token: write contents: read steps: + - name: Secure runner + uses: tempoxyz/gh-actions/actions/secure-runner@ca2b15de1d1f6edd2276736187d7e4c2d898972c - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false @@ -31,9 +34,11 @@ jobs: with: cache-on-failure: true - name: Install cargo-codspeed - uses: taiki-e/install-action@b651345a718c8f44efa2460560b3dbf29cbd7ee1 # v2 + uses: tempoxyz/gh-actions/vendor/taiki-e/install-action@25cce154e7fb10f99361a166468a6c56b9c31aa3 with: - tool: cargo-codspeed + tool: cargo-codspeed@5.0.2 + checksum: true + fallback: cargo-binstall - name: Build the benchmark target(s) run: cargo codspeed build --profile profiling --features="arbitrary" - name: Run the benchmarks diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 9f36c56..40e848f 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -16,6 +16,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 30 permissions: + id-token: write contents: read strategy: fail-fast: false @@ -23,6 +24,8 @@ jobs: rust: ["stable", "beta", "nightly", "1.85"] # MSRV flags: ["--no-default-features", "", "--all-features"] steps: + - name: Secure runner + uses: tempoxyz/gh-actions/actions/secure-runner@ca2b15de1d1f6edd2276736187d7e4c2d898972c - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false @@ -43,6 +46,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 30 permissions: + id-token: write contents: read strategy: fail-fast: false @@ -51,6 +55,8 @@ jobs: env: MIRIFLAGS: -Zmiri-strict-provenance steps: + - name: Secure runner + uses: tempoxyz/gh-actions/actions/secure-runner@ca2b15de1d1f6edd2276736187d7e4c2d898972c - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false @@ -68,17 +74,23 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 30 permissions: + id-token: write contents: read steps: + - name: Secure runner + uses: tempoxyz/gh-actions/actions/secure-runner@ca2b15de1d1f6edd2276736187d7e4c2d898972c - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # master with: toolchain: stable - - uses: taiki-e/install-action@b651345a718c8f44efa2460560b3dbf29cbd7ee1 # v2 + - name: Install cargo-hack + uses: tempoxyz/gh-actions/vendor/taiki-e/install-action@25cce154e7fb10f99361a166468a6c56b9c31aa3 with: - tool: cargo-hack + tool: cargo-hack@0.6.45 + checksum: true + fallback: none - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 with: cache-on-failure: true @@ -89,8 +101,11 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 30 permissions: + id-token: write contents: read steps: + - name: Secure runner + uses: tempoxyz/gh-actions/actions/secure-runner@ca2b15de1d1f6edd2276736187d7e4c2d898972c - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false @@ -109,8 +124,11 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 30 permissions: + id-token: write contents: read steps: + - name: Secure runner + uses: tempoxyz/gh-actions/actions/secure-runner@ca2b15de1d1f6edd2276736187d7e4c2d898972c - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false @@ -128,8 +146,11 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 30 permissions: + id-token: write contents: read steps: + - name: Secure runner + uses: tempoxyz/gh-actions/actions/secure-runner@ca2b15de1d1f6edd2276736187d7e4c2d898972c - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false @@ -140,6 +161,26 @@ jobs: - run: cargo fmt --all --check deny: - uses: tempoxyz/ci/.github/workflows/deny.yml@main + name: cargo deny check + runs-on: ubuntu-latest + timeout-minutes: 30 permissions: contents: read + id-token: write + steps: + - name: Secure runner + uses: tempoxyz/gh-actions/actions/secure-runner@ca2b15de1d1f6edd2276736187d7e4c2d898972c # main + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # master + with: + toolchain: nightly + # Run on the protected host so dependency downloads are inspected. + - name: Install cargo-deny + uses: tempoxyz/gh-actions/vendor/taiki-e/install-action@25cce154e7fb10f99361a166468a6c56b9c31aa3 # main + with: + tool: cargo-deny@0.20.2 + checksum: true + fallback: none + - run: cargo deny --all-features check all diff --git a/.github/workflows/no_std.yml b/.github/workflows/no_std.yml index b0bf7ce..039e897 100644 --- a/.github/workflows/no_std.yml +++ b/.github/workflows/no_std.yml @@ -16,8 +16,11 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 30 permissions: + id-token: write contents: read steps: + - name: Secure runner + uses: tempoxyz/gh-actions/actions/secure-runner@ca2b15de1d1f6edd2276736187d7e4c2d898972c - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false From 427c892417f399bec62b5edb47009bfc7ec33eb9 Mon Sep 17 00:00:00 2001 From: George Niculae Date: Mon, 21 Sep 2026 11:23:16 +0300 Subject: [PATCH 2/5] chore(ci): update gh-actions pin --- .github/workflows/bench.yml | 4 ++-- .github/workflows/ci.yml | 18 +++++++++--------- .github/workflows/no_std.yml | 2 +- 3 files changed, 12 insertions(+), 12 deletions(-) diff --git a/.github/workflows/bench.yml b/.github/workflows/bench.yml index 9d0ccf0..d658c95 100644 --- a/.github/workflows/bench.yml +++ b/.github/workflows/bench.yml @@ -21,7 +21,7 @@ jobs: contents: read steps: - name: Secure runner - uses: tempoxyz/gh-actions/actions/secure-runner@ca2b15de1d1f6edd2276736187d7e4c2d898972c + uses: tempoxyz/gh-actions/actions/secure-runnerd67c611dc0050e9f3fcd5bd47f3f899a00e - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false @@ -34,7 +34,7 @@ jobs: with: cache-on-failure: true - name: Install cargo-codspeed - uses: tempoxyz/gh-actions/vendor/taiki-e/install-action@25cce154e7fb10f99361a166468a6c56b9c31aa3 + uses: tempoxyz/gh-actions/vendor/taiki-e/install-actiond67c611dc0050e9f3fcd5bd47f3f899a00e with: tool: cargo-codspeed@5.0.2 checksum: true diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 40e848f..44e3c3a 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -25,7 +25,7 @@ jobs: flags: ["--no-default-features", "", "--all-features"] steps: - name: Secure runner - uses: tempoxyz/gh-actions/actions/secure-runner@ca2b15de1d1f6edd2276736187d7e4c2d898972c + uses: tempoxyz/gh-actions/actions/secure-runnerd67c611dc0050e9f3fcd5bd47f3f899a00e - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false @@ -56,7 +56,7 @@ jobs: MIRIFLAGS: -Zmiri-strict-provenance steps: - name: Secure runner - uses: tempoxyz/gh-actions/actions/secure-runner@ca2b15de1d1f6edd2276736187d7e4c2d898972c + uses: tempoxyz/gh-actions/actions/secure-runnerd67c611dc0050e9f3fcd5bd47f3f899a00e - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false @@ -78,7 +78,7 @@ jobs: contents: read steps: - name: Secure runner - uses: tempoxyz/gh-actions/actions/secure-runner@ca2b15de1d1f6edd2276736187d7e4c2d898972c + uses: tempoxyz/gh-actions/actions/secure-runnerd67c611dc0050e9f3fcd5bd47f3f899a00e - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false @@ -86,7 +86,7 @@ jobs: with: toolchain: stable - name: Install cargo-hack - uses: tempoxyz/gh-actions/vendor/taiki-e/install-action@25cce154e7fb10f99361a166468a6c56b9c31aa3 + uses: tempoxyz/gh-actions/vendor/taiki-e/install-actiond67c611dc0050e9f3fcd5bd47f3f899a00e with: tool: cargo-hack@0.6.45 checksum: true @@ -105,7 +105,7 @@ jobs: contents: read steps: - name: Secure runner - uses: tempoxyz/gh-actions/actions/secure-runner@ca2b15de1d1f6edd2276736187d7e4c2d898972c + uses: tempoxyz/gh-actions/actions/secure-runnerd67c611dc0050e9f3fcd5bd47f3f899a00e - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false @@ -128,7 +128,7 @@ jobs: contents: read steps: - name: Secure runner - uses: tempoxyz/gh-actions/actions/secure-runner@ca2b15de1d1f6edd2276736187d7e4c2d898972c + uses: tempoxyz/gh-actions/actions/secure-runnerd67c611dc0050e9f3fcd5bd47f3f899a00e - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false @@ -150,7 +150,7 @@ jobs: contents: read steps: - name: Secure runner - uses: tempoxyz/gh-actions/actions/secure-runner@ca2b15de1d1f6edd2276736187d7e4c2d898972c + uses: tempoxyz/gh-actions/actions/secure-runnerd67c611dc0050e9f3fcd5bd47f3f899a00e - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false @@ -169,7 +169,7 @@ jobs: id-token: write steps: - name: Secure runner - uses: tempoxyz/gh-actions/actions/secure-runner@ca2b15de1d1f6edd2276736187d7e4c2d898972c # main + uses: tempoxyz/gh-actions/actions/secure-runnerd67c611dc0050e9f3fcd5bd47f3f899a00e # main - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false @@ -178,7 +178,7 @@ jobs: toolchain: nightly # Run on the protected host so dependency downloads are inspected. - name: Install cargo-deny - uses: tempoxyz/gh-actions/vendor/taiki-e/install-action@25cce154e7fb10f99361a166468a6c56b9c31aa3 # main + uses: tempoxyz/gh-actions/vendor/taiki-e/install-actiond67c611dc0050e9f3fcd5bd47f3f899a00e # main with: tool: cargo-deny@0.20.2 checksum: true diff --git a/.github/workflows/no_std.yml b/.github/workflows/no_std.yml index 039e897..44e08a7 100644 --- a/.github/workflows/no_std.yml +++ b/.github/workflows/no_std.yml @@ -20,7 +20,7 @@ jobs: contents: read steps: - name: Secure runner - uses: tempoxyz/gh-actions/actions/secure-runner@ca2b15de1d1f6edd2276736187d7e4c2d898972c + uses: tempoxyz/gh-actions/actions/secure-runnerd67c611dc0050e9f3fcd5bd47f3f899a00e - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false From 418ad145f900b7ccb654c62a103a59fe87871558 Mon Sep 17 00:00:00 2001 From: George Niculae Date: Mon, 21 Sep 2026 11:27:58 +0300 Subject: [PATCH 3/5] fix(ci): correct gh-actions references --- .github/workflows/bench.yml | 4 ++-- .github/workflows/ci.yml | 18 +++++++++--------- .github/workflows/no_std.yml | 2 +- 3 files changed, 12 insertions(+), 12 deletions(-) diff --git a/.github/workflows/bench.yml b/.github/workflows/bench.yml index d658c95..d9713d3 100644 --- a/.github/workflows/bench.yml +++ b/.github/workflows/bench.yml @@ -21,7 +21,7 @@ jobs: contents: read steps: - name: Secure runner - uses: tempoxyz/gh-actions/actions/secure-runnerd67c611dc0050e9f3fcd5bd47f3f899a00e + uses: tempoxyz/gh-actions/actions/secure-runner@68851d67c611dc0050e9f3fcd5bd47f3f899a00e - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false @@ -34,7 +34,7 @@ jobs: with: cache-on-failure: true - name: Install cargo-codspeed - uses: tempoxyz/gh-actions/vendor/taiki-e/install-actiond67c611dc0050e9f3fcd5bd47f3f899a00e + uses: tempoxyz/gh-actions/vendor/taiki-e/install-action@68851d67c611dc0050e9f3fcd5bd47f3f899a00e with: tool: cargo-codspeed@5.0.2 checksum: true diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 44e3c3a..4876718 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -25,7 +25,7 @@ jobs: flags: ["--no-default-features", "", "--all-features"] steps: - name: Secure runner - uses: tempoxyz/gh-actions/actions/secure-runnerd67c611dc0050e9f3fcd5bd47f3f899a00e + uses: tempoxyz/gh-actions/actions/secure-runner@68851d67c611dc0050e9f3fcd5bd47f3f899a00e - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false @@ -56,7 +56,7 @@ jobs: MIRIFLAGS: -Zmiri-strict-provenance steps: - name: Secure runner - uses: tempoxyz/gh-actions/actions/secure-runnerd67c611dc0050e9f3fcd5bd47f3f899a00e + uses: tempoxyz/gh-actions/actions/secure-runner@68851d67c611dc0050e9f3fcd5bd47f3f899a00e - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false @@ -78,7 +78,7 @@ jobs: contents: read steps: - name: Secure runner - uses: tempoxyz/gh-actions/actions/secure-runnerd67c611dc0050e9f3fcd5bd47f3f899a00e + uses: tempoxyz/gh-actions/actions/secure-runner@68851d67c611dc0050e9f3fcd5bd47f3f899a00e - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false @@ -86,7 +86,7 @@ jobs: with: toolchain: stable - name: Install cargo-hack - uses: tempoxyz/gh-actions/vendor/taiki-e/install-actiond67c611dc0050e9f3fcd5bd47f3f899a00e + uses: tempoxyz/gh-actions/vendor/taiki-e/install-action@68851d67c611dc0050e9f3fcd5bd47f3f899a00e with: tool: cargo-hack@0.6.45 checksum: true @@ -105,7 +105,7 @@ jobs: contents: read steps: - name: Secure runner - uses: tempoxyz/gh-actions/actions/secure-runnerd67c611dc0050e9f3fcd5bd47f3f899a00e + uses: tempoxyz/gh-actions/actions/secure-runner@68851d67c611dc0050e9f3fcd5bd47f3f899a00e - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false @@ -128,7 +128,7 @@ jobs: contents: read steps: - name: Secure runner - uses: tempoxyz/gh-actions/actions/secure-runnerd67c611dc0050e9f3fcd5bd47f3f899a00e + uses: tempoxyz/gh-actions/actions/secure-runner@68851d67c611dc0050e9f3fcd5bd47f3f899a00e - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false @@ -150,7 +150,7 @@ jobs: contents: read steps: - name: Secure runner - uses: tempoxyz/gh-actions/actions/secure-runnerd67c611dc0050e9f3fcd5bd47f3f899a00e + uses: tempoxyz/gh-actions/actions/secure-runner@68851d67c611dc0050e9f3fcd5bd47f3f899a00e - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false @@ -169,7 +169,7 @@ jobs: id-token: write steps: - name: Secure runner - uses: tempoxyz/gh-actions/actions/secure-runnerd67c611dc0050e9f3fcd5bd47f3f899a00e # main + uses: tempoxyz/gh-actions/actions/secure-runner@68851d67c611dc0050e9f3fcd5bd47f3f899a00e # main - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false @@ -178,7 +178,7 @@ jobs: toolchain: nightly # Run on the protected host so dependency downloads are inspected. - name: Install cargo-deny - uses: tempoxyz/gh-actions/vendor/taiki-e/install-actiond67c611dc0050e9f3fcd5bd47f3f899a00e # main + uses: tempoxyz/gh-actions/vendor/taiki-e/install-action@68851d67c611dc0050e9f3fcd5bd47f3f899a00e # main with: tool: cargo-deny@0.20.2 checksum: true diff --git a/.github/workflows/no_std.yml b/.github/workflows/no_std.yml index 44e08a7..4f13d5c 100644 --- a/.github/workflows/no_std.yml +++ b/.github/workflows/no_std.yml @@ -20,7 +20,7 @@ jobs: contents: read steps: - name: Secure runner - uses: tempoxyz/gh-actions/actions/secure-runnerd67c611dc0050e9f3fcd5bd47f3f899a00e + uses: tempoxyz/gh-actions/actions/secure-runner@68851d67c611dc0050e9f3fcd5bd47f3f899a00e - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false From 1bdf8adfdbbeb8fb1d57ef02e836956c53841c38 Mon Sep 17 00:00:00 2001 From: George Niculae Date: Tue, 22 Sep 2026 07:29:26 +0300 Subject: [PATCH 4/5] ci: install cargo-codspeed from source --- .github/workflows/bench.yml | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/.github/workflows/bench.yml b/.github/workflows/bench.yml index d9713d3..7302226 100644 --- a/.github/workflows/bench.yml +++ b/.github/workflows/bench.yml @@ -34,11 +34,7 @@ jobs: with: cache-on-failure: true - name: Install cargo-codspeed - uses: tempoxyz/gh-actions/vendor/taiki-e/install-action@68851d67c611dc0050e9f3fcd5bd47f3f899a00e - with: - tool: cargo-codspeed@5.0.2 - checksum: true - fallback: cargo-binstall + run: cargo install cargo-codspeed --version 5.0.2 --locked - name: Build the benchmark target(s) run: cargo codspeed build --profile profiling --features="arbitrary" - name: Run the benchmarks From 1af19c592c9390c0a4f9c75a0f2a8b4a370d469d Mon Sep 17 00:00:00 2001 From: George Niculae Date: Tue, 22 Sep 2026 07:33:02 +0300 Subject: [PATCH 5/5] ci: exclude installed tools from benchmark cache --- .github/workflows/bench.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/bench.yml b/.github/workflows/bench.yml index 7302226..53a4096 100644 --- a/.github/workflows/bench.yml +++ b/.github/workflows/bench.yml @@ -33,6 +33,7 @@ jobs: - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 with: cache-on-failure: true + cache-bin: false - name: Install cargo-codspeed run: cargo install cargo-codspeed --version 5.0.2 --locked - name: Build the benchmark target(s)