From d9f9f42161fb304219758f4d928aa5c30f5edae7 Mon Sep 17 00:00:00 2001 From: Albert Hui Date: Thu, 20 Aug 2026 03:15:26 +0000 Subject: [PATCH] chore(ci): repin fleet-ci to the revision that gates the unsafe lint Moves this repo from 9234e1fa to 85c7263, which adds two things it did not have. `Unsafe lint audit` is a new job INSIDE the aggregate gate. It asserts that every workspace member EFFECTIVELY forbids or denies `unsafe_code` -- the part the compiler cannot tell you. Cargo does not apply workspace lints implicitly: a member with no `[lints]` table does not inherit them, and a member with its own `[lints]` table replaces inheritance rather than extending it. Either way the crate compiles with `unsafe` permitted while the workspace root still reads compliant. Surveying the root scores such a repo green, which is how five published crates across two repos went unnoticed until this check existed. It replaces the `Unsafe Audit (cargo-geiger)` job that eighteen repos carried as a SIBLING of the shared-workflow call. That job could not fail -- `|| true` on the step and `continue-on-error` on the job -- and, being a sibling rather than a job inside the reusable workflow, `ci / All checks` never reached it and branch protection never required it. The coverage job also gains `coverage-metric` (lines | functions | both) and `coverage-include-regex`, which let a repo gate on functions or hold one path at 100% while the rest carries tracked debt. Both default to today's behaviour, so this repo's coverage posture is unchanged unless it opts in. No repo-side change is needed: the whole fleet already passes the unsafe audit. This revision also bounds every job with `timeout-minutes` and retries `apt-get update` behind a 300s timeout. Nothing had a ceiling before, so a hung apt consumed GitHub's full six-hour job limit across six repos yesterday and reported a red gate that looked like a code failure. --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 467e742..f285503 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -18,4 +18,4 @@ jobs: # and MSRV is read from rust-version. Anything that needed configuring would be # a behaviour change smuggled in by an adoption PR, so there is nothing here. ci: - uses: SecurityRonin/fleet-ci/.github/workflows/rust-ci.yml@9234e1fa9f85b14a8d6fddc7a8f7378f7e30b183 + uses: SecurityRonin/fleet-ci/.github/workflows/rust-ci.yml@85c7263e5e1a25a090f602419ac27f87aeb1d1e3