chore(deps): batch 16 open Renovate PRs (#19-#38) - #39
Conversation
The preceding commit bumped `nixpkgs-reference` to 52eeb0a, moving the
spec-harness oracle from bash 5.3p9 / coreutils 9.10 to bash 5.3p15 /
coreutils 9.11. The `[reference]` block in tests/spec/REFERENCE.md and
the `on_disk_reference_doc_parses` test must move with it — the test
deliberately hardcodes the pin so a bump cannot land silently.
Verification against the new oracle:
- `cargo xtask compat` — 55 cases, 0 regressions. No fixture needed
re-recording, so the "bumps re-record fixtures" clause of the
upgrade policy is satisfied with no fixture changes.
- `cargo xtask spec versions` — now reports "pin matches devshell:
ok" and no floating drift.
This also clears drift that predates the bump: REFERENCE.md recorded
rev d233902 / coreutils 9.10 while flake.nix pinned 536c906 /
coreutils 9.11, so `cargo xtask spec versions` was already failing on
main. It passes again as of this commit.
Deviation from the REFERENCE.md upgrade policy: that policy asks for
the `[reference]` block and the `nixpkgs-reference.url` rev to change
in one commit. They are split here because the rev bump is Renovate's
authored commit (cherry-picked from #22) and folding this content into
it would misattribute authorship. Both land in the same PR, and every
commit in the range leaves `cargo test --all` green.
Two related problems in the `default` devShell.
1. Nested list. `chk.passthru.devPackages` is itself a list, and it was
included as an *element* of `extraRustTools`. Nixpkgs 26.05 warns on
this and will drop support:
Dependency of package 'nix-shell' uses a nested list in
attribute 'buildInputs'. This is deprecated as of Nixpkgs
release 26.05.
2. Toolchain shadowing. `devPackages` carries the mkCheck rust
toolchain (rustc + cargo + clippy-driver + rustfmt all from one
release), while `corePkgs` carries git-hooks.nix's own standalone
`cargo` / `clippy` / `rustfmt` derivations, which can come from a
different rustc release. Both land on PATH and earlier entries win.
These interact: because the nested list happened to be the first
element of `extraRustTools`, flattening put the toolchain first and the
ordering was correct *by accident*. Simply deleting the nested entry —
which looks like removing a pure duplicate, since `devPackages` is also
spliced in as `extraDev` — preserves the package set but changes the
order, letting corePkgs' cargo/clippy shadow the toolchain:
rustc 1.97.1 (8bab26f4f) <- rust-default
cargo 1.97.0 <- corePkgs
clippy-driver 0.1.97 (2d8144b78) <- corePkgs
A clippy-driver built by a different rustc than the one that compiled
the dependency rlibs makes every workspace crate fail to build:
error[E0514]: found crate `quote` compiled by an incompatible
version of rustc
Fixed by dropping the nested element and reordering to
`extraDev ++ corePkgs ++ extraRustTools`, matching the ordering used in
freminal's flake. All four binaries now resolve from a single
`rust-default-1.97.1` built from 8bab26f4f, and the deprecation warning
is gone. Comments record why the order is load-bearing.
📝 WalkthroughWalkthroughThe pull request refreshes GitHub Actions, Rust workspace dependencies, and Nix inputs. It changes development-shell package ordering and updates pinned Bash, coreutils, nixpkgs, and reference test values. ChangesMaintenance refresh
Estimated code review effort: 3 (Moderate) | ~20 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
There was a problem hiding this comment.
Pull request overview
Batches 16 Renovate dependency/action updates into one PR, while also fixing two follow-on maintenance issues (Nix devShell PATH/toolchain ordering and the spec oracle pin sync) so the full workspace can be verified and merged in one shot.
Changes:
- Updates a set of Rust workspace dependencies (including
synto v3) and refreshesCargo.lockaccordingly. - Fixes Nix devShell
buildInputsordering to avoid mixed toolchains onPATH(and removes deprecated nestedbuildInputslist usage). - Syncs the spec reference pin across
flake.nix,flake.lock,tests/spec/REFERENCE.md, and thextaskpin assertion test.
Reviewed changes
Copilot reviewed 6 out of 8 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| xtask/src/spec/mod.rs | Updates the hardcoded pin assertions to match the new reference versions/rev. |
| tests/spec/REFERENCE.md | Bumps the pinned reference bash/coreutils/nixpkgs rev and updates the pin date. |
| flake.nix | Updates nixpkgs-reference rev and reorders devShell inputs to keep the mkCheck toolchain first on PATH. |
| flake.lock | Updates the locked nixpkgs-reference metadata (rev/hash/lastModified). |
| Cargo.toml | Bumps workspace dependency versions (anyhow/clap/serde*/toml/proc-macro2/quote/syn/libc/base64/trybuild). |
| Cargo.lock | Regenerates the lockfile to reflect the dependency bumps (including syn 3.0.3 plus retained syn 2.0.118 for transitive users). |
| .github/workflows/update-flakes.yaml | Updates actions/checkout digest used by the scheduled flake update workflow. |
| .github/workflows/ci.yml | Updates action digests for checkout, Determinate Nix setup, and rust-toolchain installation in CI. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Around line 22-24: Update all three actions/checkout steps in the CI workflow
to set persist-credentials to false, including the visible checkout step and its
two counterparts. Preserve the existing fetch-depth and checkout configuration.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: ca904c7f-a46a-49f0-99f7-5bb754a91162
⛔ Files ignored due to path filters (2)
Cargo.lockis excluded by!**/*.lockflake.lockis excluded by!**/*.lock
📒 Files selected for processing (6)
.github/workflows/ci.yml.github/workflows/update-flakes.yamlCargo.tomlflake.nixtests/spec/REFERENCE.mdxtask/src/spec/mod.rs
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | ||
| with: | ||
| fetch-depth: 0 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
while IFS=: read -r line _; do
sed -n "${line},$((line + 5))p" .github/workflows/ci.yml
done < <(rg -n 'uses: actions/checkout@' .github/workflows/ci.yml)Repository: fredsystems/fredshell
Length of output: 211
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- checkout locations ---'
rg -n -C 8 'uses:\s*actions/checkout@' .github/workflows/ci.yml
printf '%s\n' '--- workflow triggers and permissions ---'
sed -n '1,130p' .github/workflows/ci.yml
printf '%s\n' '--- repository-controlled commands ---'
rg -n -C 3 'pre-commit|cargo xtask|nix ' .github/workflows/ci.ymlRepository: fredsystems/fredshell
Length of output: 151
🏁 Script executed:
#!/usr/bin/env bash
set -u
printf '%s\n' '--- workflow size ---'
wc -l .github/workflows/ci.yml
printf '%s\n' '--- checkout lines ---'
grep -n -A5 -B2 'actions/checkout@' .github/workflows/ci.yml
printf '%s\n' '--- relevant commands ---'
grep -n -A3 -B3 -E 'pre-commit|cargo xtask|nix ' .github/workflows/ci.yml
printf '%s\n' '--- top-level workflow ---'
sed -n '1,110p' .github/workflows/ci.ymlRepository: fredsystems/fredshell
Length of output: 151
🌐 Web query:
fredsystems/fredshell .github/workflows/ci.yml actions/checkout persist-credentials
💡 Result:
In the context of a GitHub Actions workflow using actions/checkout, the persist-credentials input is a boolean setting that determines whether the authentication token or SSH key used to check out the repository is configured in the local Git configuration [1][2]. When set to true (which is the default behavior), the action persists credentials into the environment [1][3]. This enables subsequent steps in the same job to run authenticated Git commands (such as git fetch, git push, or git pull) without requiring additional authentication [1][4]. For security reasons, the action removes these credentials during the post-job cleanup [1][3]. In newer versions of actions/checkout, these credentials are stored in a separate file under $RUNNER_TEMP rather than directly in.git/config, enhancing security by isolating the credentials [1][4]. If you set persist-credentials: false, the action will not store the authentication token or SSH key in the local Git configuration, preventing subsequent steps from using those credentials for Git operations [1][5]. This is often recommended for security-conscious workflows where you wish to limit the potential exposure of the token to other steps [5]. Regarding fredsystems/fredshell, a search of the provided repositories under the fredsystems organization did not reveal a specific project named fredshell [6][7][8]. It is possible this refers to a private repository, a typo, or a project that is not indexed publicly. The organization fredsystems is primarily known for the personal projects of Fred Clausen, including NixOS configurations and terminal utilities [7][8][9].
Citations:
- 1: https://github.com/actions/checkout
- 2: https://github.com/actions/checkout/blob/main/action.yml
- 3: https://github.com/marketplace/actions/checkout
- 4: https://github.com/actions/checkout/tree/v6.0.0
- 5: Remove
persist-credentialsor change the default tofalseactions/checkout#485 - 6: https://github.com/fredsystems/freminal
- 7: https://github.com/fredclausen
- 8: https://github.com/fredsystems/nixos
- 9: https://fredclausen.com/
🌐 Web query:
site:github.com/fredsystems/fredshell ".github/workflows/ci.yml"
💡 Result:
Found it: fredsystems/fredshell/.github/workflows/ci.yml on the main branch. (github.com)
Citations:
🌐 Web query:
https://github.com/fredsystems/fredshell/blob/main/.github/workflows/ci.yml "actions/checkout"
💡 Result:
The actions/checkout action is a standard, official GitHub Action used in GitHub Actions workflows to clone a repository into the workflow runner's environment [1][2][3]. When used in a CI/CD configuration file like.github/workflows/ci.yml (such as the one referenced in your query), this action allows the runner to access the source code of the repository [3][4]. Without this step, the runner environment would be empty, preventing it from performing tasks like building, testing, or linting the code [4]. Key functions of actions/checkout include: - Cloning the Repository: By default, it clones the repository where the workflow is running, but it can be configured to clone different repositories or specific branches/tags/commits using the with keyword [3][5][4]. - Setting Up the Environment: It sets the $GITHUB_WORKSPACE environment variable to the directory where the code is placed [4]. - Configuration Options: It supports various configurations such as: - fetch-depth: Controls how much history is fetched (default is 1) [1][2][5]. - submodules: Allows for the recursive checkout of git submodules [1][2]. - persist-credentials: Determines whether to configure the git token/SSH key with the local git configuration [1][2]. - sparse-checkout: Enables checking out only specific files or directories [1][2][3]. In the context of the fredsystems organization—which focuses on NixOS configurations and developer tools maintained by Fred Clausen—this action is typical for ensuring that automated CI pipelines have the necessary access to project files to execute defined tasks [6][7][8].
Citations:
- 1: https://github.com/actions/checkout/?tab=readme-ov-file
- 2: https://github.com/actions/checkout
- 3: https://spacelift.io/blog/github-actions-checkout
- 4: https://graphite.com/guides/github-actions-checkout
- 5: https://stackoverflow.com/questions/67131269/what-is-the-use-of-actions-checkout-in-github-actions
- 6: https://github.com/fredclausen
- 7: https://github.com/fredsystems/nixos
- 8: https://fredclausen.com/
🌐 Web query:
site:github.com/fredsystems/fredshell/blob/main/.github/workflows/ci.yml "persist-credentials"
💡 Result:
The matching GitHub Actions setting is:
persist-credentials: falseIt disables persistence of the checkout token for later workflow steps. (github.com)
Citations:
🌐 Web query:
site:github.com/fredsystems/fredshell/blob/main/.github/workflows/ci.yml "pull_request" OR "pre-commit" OR "cargo xtask" OR "nix"
💡 Result:
The workflow contains all four requested terms:
pull_requesttriggerpre-commit run --all-filescargo xtask check- Multiple Nix setup and
nix developcommands
It also runs cargo xtask compat --json target/compat.json. [1] (github.com)
Citations:
Disable checkout credential persistence in all CI jobs.
The workflow runs on pull_request and executes repository-controlled commands. Set persist-credentials: false on all three actions/checkout steps so later commands cannot access the checkout token.
🧰 Tools
🪛 zizmor (1.28.0)
[warning] 22-24: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ci.yml around lines 22 - 24, Update all three
actions/checkout steps in the CI workflow to set persist-credentials to false,
including the visible checkout step and its two counterparts. Preserve the
existing fetch-depth and checkout configuration.
Source: Linters/SAST tools
Renovate force-updated #22 from 52eeb0a to aec71e3 while this batch was being assembled, so the earlier cherry-pick of that PR was already stale. This moves the pin to the digest #22 currently proposes; flake.nix and the flake.lock entry now match its head commit exactly. The oracle versions do not move: both 52eeb0a and aec71e3 provide bash 5.3p15 and coreutils 9.11. No fixture needed re-recording. Because the rev is recorded in three places, all three move together: - flake.nix / flake.lock — the pin itself - tests/spec/REFERENCE.md — the [reference] block - xtask/src/spec/mod.rs — on_disk_reference_doc_parses Verified in a devshell built from the new pin: `cargo xtask spec versions` reports "pin matches devshell: ok" with no drift, `cargo xtask compat` reports 55 cases / 0 regressions, and `cargo xtask check` passes.
Consolidates the 16 open Renovate PRs into a single branch so they can be verified together and land as one merge.
Closes #19
Closes #20
Closes #21
Closes #22
Closes #23
Closes #24
Closes #25
Closes #26
Closes #27
Closes #28
Closes #32
Closes #33
Closes #34
Closes #35
Closes #37
Closes #38
What landed
Each bump is its own commit so the range stays bisectable. Cargo.lock was regenerated per-crate with
cargo update -p <crate> --precise <version>rather than by merging 12 conflicting lockfiles, so the lock contains exactly the versions the PRs proposed with no incidental transitive drift.anyhow-> 1.0.104clap-> 4.6.5serde-> 1.0.229serde_json-> 1.0.151toml-> 1.1.4proc-macro2-> 1.0.107quote-> 1.0.47syn-> 3.0.3libc-> 0.2.189base64-> 0.23.0trybuild-> 1.0.120actions/checkout-> 3d3c42eDeterminateSystems/determinate-nix-action-> 61cbfe2dtolnay/rust-toolchain-> 2c7215fnixpkgs-reference-> aec71e3syn: #38 supersedes #34
#38 (
syn3.0.3) and #34 (syn2.0.119) both rewrite the same dependency line and are mutually exclusive. #38 is taken; #34 is closed as superseded.syn3.0.3 was already entering the tree transitively viaclap_derive4.6.4, andfredshell-spec-macroscompiles against the 3.0 API unchanged.syn2.0.118 remains in the lock forwasm-bindgen-macro-supportandzerocopy-derive, which is expected.Two fixes needed to make the batch land
Neither is a dependency bump; both are consequences of the batch and are separate commits.
fix(nix): devShell buildInputs orderingThe nixpkgs 26.05 deprecation warning on shell entry —
— came from
chk.passthru.devPackages(itself a list) being an element ofextraRustTools. Removing it looks like deleting a pure duplicate, since the same list is spliced in again asextraDev. It is not: the nested entry was first, so flattening put the rust toolchain first on PATH and the ordering was correct by accident. Removing it preserves the package set but changes the order, lettingcorePkgs' standalone cargo/clippy shadow the toolchain:A
clippy-driverbuilt by a different rustc than the one that compiled the dependency rlibs breaks every workspace crate witherror[E0514]: found crate 'quote' compiled by an incompatible version of rustc.Fixed by dropping the nested element and reordering to
extraDev ++ corePkgs ++ extraRustTools, matching freminal's flake. All four binaries now resolve from a singlerust-default-1.97.1(8bab26f4f), and the warning is gone. The ordering is now documented as load-bearing.chore(spec): REFERENCE.md pin sync#22 moves the spec oracle from bash 5.3p9 / coreutils 9.10 to bash 5.3p15 / coreutils 9.11.
Renovate force-updated #22 from
52eeb0atoaec71e3while this batch was being assembled, so the branch was re-pointed at the newer digest;flake.nixand theflake.lockentry now match #22's head commit exactly. Both digests provide the same bash 5.3p15 / coreutils 9.11, so the oracle does not move and no fixture is affected. Per the upgrade policy intests/spec/REFERENCE.md, the[reference]block moves with the rev, as doeson_disk_reference_doc_parses, which deliberately hardcodes the pin so a bump cannot land silently.cargo xtask compatreports 0 regressions against bash 5.3p15, so no fixture needed re-recording.This also clears drift that predates the batch: REFERENCE.md recorded rev
d233902/ coreutils 9.10 while flake.nix pinned536c906/ coreutils 9.11, socargo xtask spec versionswas already failing onmain. It passes again.Worth noting for a future change:
spec versionscompares only the bash and coreutils versions, notnixpkgs_rev. That is why the rev drifted unnoticed onmain. Tightening it to also compare the rev would have caught this, but that is a behavior change and is out of scope here.Verification
Full suite on a cold
cargo clean, rust 1.97.1:cargo fmt --all -- --checkcargo clippy --all-targets --all-features -- -D warningscargo test --allcargo-machetecargo xtask checkcargo xtask compatcargo xtask spec versionsnix flake checkEvery commit in the range was gated by the
xtask-checkpre-commit hook, so each leaves the tree green.Known unrelated failure
cargo xtask check-specsreports 21 orphan violations. This is pre-existing onmainand unrelated: PLAN_07 has 5 of 10 spec sheets written, so corpus cases are not yet all owned by a sheet.check_specsreads onlyDocuments/specs/andtests/spec/, and this branch touches no file in either, so the result is identical tomain. It is not a CI gate — CI runsxtask checkandxtask compat.Summary by CodeRabbit
Chores
Tests
Documentation