diff --git a/.github/workflows/bindings_ci.yml b/.github/workflows/bindings_ci.yml index 3c5c1d033..cb53c10f6 100644 --- a/.github/workflows/bindings_ci.yml +++ b/.github/workflows/bindings_ci.yml @@ -38,12 +38,14 @@ jobs: persist-credentials: false - name: Install protoc - uses: taiki-e/install-action@85b24a67ef0c632dfefad70b9d5ce8fddb040754 # v2 + uses: taiki-e/install-action@85b24a67ef0c632dfefad70b9d5ce8fddb040754 # v2.75.10 with: tool: protoc@3.20.3 - name: Install Rust - uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7 # stable + uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1 + with: + toolchain: stable # Cargo config can screw with caching and is only used for alias config # and extra lints, which we don't care about here @@ -51,12 +53,12 @@ jobs: run: rm .cargo/config.toml - name: Load cache - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2 + uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 with: save-if: ${{ github.ref == 'refs/heads/main' }} - name: Get xtask - uses: actions/cache/restore@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5 + uses: actions/cache/restore@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4 with: path: target/debug/xtask key: "${{ needs.xtask.outputs.cachekey-linux }}" @@ -101,7 +103,9 @@ jobs: ndk-version: r27 - name: Install Rust - uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7 # stable + uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1 + with: + toolchain: stable # Cargo config can screw with caching and is only used for alias config # and extra lints, which we don't care about here @@ -109,12 +113,12 @@ jobs: run: rm .cargo/config.toml - name: Load cache - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2 + uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 with: save-if: ${{ github.ref == 'refs/heads/main' }} - name: Get xtask - uses: actions/cache/restore@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5 + uses: actions/cache/restore@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4 with: path: target/debug/xtask key: "${{ needs.xtask.outputs.cachekey-linux }}" @@ -149,12 +153,14 @@ jobs: # install protoc in case we end up rebuilding opentelemetry-proto - name: Install protoc - uses: taiki-e/install-action@85b24a67ef0c632dfefad70b9d5ce8fddb040754 # v2 + uses: taiki-e/install-action@85b24a67ef0c632dfefad70b9d5ce8fddb040754 # v2.75.10 with: tool: protoc@3.20.3 - name: Install Rust - uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7 # stable + uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1 + with: + toolchain: stable - name: Install aarch64-apple-ios target run: rustup target install aarch64-apple-ios @@ -165,12 +171,12 @@ jobs: run: rm .cargo/config.toml - name: Load cache - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2 + uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 with: save-if: ${{ github.ref == 'refs/heads/main' }} - name: Get xtask - uses: actions/cache/restore@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5 + uses: actions/cache/restore@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4 with: path: target/debug/xtask key: "${{ needs.xtask.outputs.cachekey-macos }}" @@ -206,12 +212,14 @@ jobs: # install protoc in case we end up rebuilding opentelemetry-proto - name: Install protoc - uses: taiki-e/install-action@85b24a67ef0c632dfefad70b9d5ce8fddb040754 # v2 + uses: taiki-e/install-action@85b24a67ef0c632dfefad70b9d5ce8fddb040754 # v2.75.10 with: tool: protoc@3.20.3 - name: Install Rust - uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7 # stable + uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1 + with: + toolchain: stable - name: Add rust targets run: | @@ -223,7 +231,7 @@ jobs: run: rm .cargo/config.toml - name: Load cache - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2 + uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 with: save-if: ${{ github.ref == 'refs/heads/main' }} diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index bdb712905..85dc159a4 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -49,7 +49,9 @@ jobs: persist-credentials: false - name: Install Rust - uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7 # stable + uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1 + with: + toolchain: stable - name: Install libsqlite run: | @@ -57,7 +59,7 @@ jobs: sudo apt-get install libsqlite3-dev - name: Load cache - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2 + uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 with: # use a separate cache for each job to work around # https://github.com/Swatinem/rust-cache/issues/124 @@ -73,7 +75,7 @@ jobs: tool: nextest - name: Get xtask - uses: actions/cache/restore@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5 + uses: actions/cache/restore@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4 with: path: target/debug/xtask key: "${{ needs.xtask.outputs.cachekey-linux }}" @@ -95,10 +97,12 @@ jobs: persist-credentials: false - name: Install Rust - uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7 # stable + uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1 + with: + toolchain: stable - name: Load cache - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2 + uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 with: save-if: ${{ github.ref == 'refs/heads/main' }} @@ -108,7 +112,7 @@ jobs: tool: nextest - name: Get xtask - uses: actions/cache/restore@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5 + uses: actions/cache/restore@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4 with: path: target/debug/xtask key: "${{ needs.xtask.outputs.cachekey-linux }}" @@ -135,12 +139,13 @@ jobs: sudo apt-get install libsqlite3-dev - name: Install Rust - uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7 # stable + uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1 with: + toolchain: stable components: clippy - name: Load cache - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2 + uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 with: save-if: ${{ github.ref == 'refs/heads/main' }} @@ -150,7 +155,7 @@ jobs: tool: nextest - name: Get xtask - uses: actions/cache/restore@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5 + uses: actions/cache/restore@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4 with: path: target/debug/xtask key: "${{ needs.xtask.outputs.cachekey-linux }}" @@ -187,7 +192,7 @@ jobs: persist-credentials: false - name: Install protoc - uses: taiki-e/install-action@85b24a67ef0c632dfefad70b9d5ce8fddb040754 # v2 + uses: taiki-e/install-action@85b24a67ef0c632dfefad70b9d5ce8fddb040754 # v2.75.10 with: tool: protoc@3.20.3 @@ -198,12 +203,12 @@ jobs: sudo apt-get install libsqlite3-dev - name: Install Rust toolchain - uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7 # master + uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1 with: toolchain: ${{ matrix.rust }} - name: Load cache - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2 + uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 with: save-if: ${{ github.ref == 'refs/heads/main' }} @@ -263,8 +268,9 @@ jobs: persist-credentials: false - name: Install Rust - uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7 # stable + uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1 with: + toolchain: stable targets: wasm32-unknown-unknown components: clippy @@ -275,7 +281,7 @@ jobs: version: v0.13.1 - name: Load cache - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2 + uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 with: # use a separate cache for each job to work around # https://github.com/Swatinem/rust-cache/issues/124 @@ -291,7 +297,7 @@ jobs: tool: nextest - name: Get xtask - uses: actions/cache/restore@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5 + uses: actions/cache/restore@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4 with: path: target/debug/xtask key: "${{ needs.xtask.outputs.cachekey-linux }}" @@ -331,23 +337,23 @@ jobs: persist-credentials: false - name: Install protoc - uses: taiki-e/install-action@85b24a67ef0c632dfefad70b9d5ce8fddb040754 # v2 + uses: taiki-e/install-action@85b24a67ef0c632dfefad70b9d5ce8fddb040754 # v2.75.10 with: tool: protoc@3.20.3 - name: Install Rust - uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7 # master + uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1 with: toolchain: nightly-2026-02-26 components: clippy, rustfmt - name: Load cache - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2 + uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 with: save-if: ${{ github.ref == 'refs/heads/main' }} - name: Get xtask - uses: actions/cache/restore@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5 + uses: actions/cache/restore@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4 with: path: target/debug/xtask key: "${{ needs.xtask.outputs.cachekey-linux }}" @@ -397,10 +403,12 @@ jobs: sudo apt-get install libsqlite3-dev - name: Install Rust - uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7 # stable + uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1 + with: + toolchain: stable - name: Load cache - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2 + uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 with: save-if: ${{ github.ref == 'refs/heads/main' }} diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml index 62dbea889..a8014888b 100644 --- a/.github/workflows/coverage.yml +++ b/.github/workflows/coverage.yml @@ -112,7 +112,9 @@ jobs: sudo rm -rf /var/lib/apt/lists/* - name: Install Rust - uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7 # stable + uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1 + with: + toolchain: stable # Cargo config can screw with caching and is only used for alias config # and extra lints, which we don't care about here @@ -120,7 +122,7 @@ jobs: run: rm .cargo/config.toml - name: Load cache - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2 + uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 with: prefix-key: "coverage" save-if: ${{ github.ref == 'refs/heads/main' }} @@ -131,7 +133,7 @@ jobs: tool: nextest,cargo-llvm-cov - name: Get xtask - uses: actions/cache/restore@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5 + uses: actions/cache/restore@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4 with: path: target/debug/xtask key: "${{ needs.xtask.outputs.cachekey-linux }}" @@ -169,7 +171,7 @@ jobs: # The actual upload to Codecov is executed by a different workflow `upload_coverage.yml`. # The reason for this split is because `on.pull_request` workflows don't have access to secrets. - name: Store coverage report in artifacts - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7 + uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0 with: name: codecov_report path: | diff --git a/.github/workflows/deny.yml b/.github/workflows/deny.yml index d6e708eba..0743571ca 100644 --- a/.github/workflows/deny.yml +++ b/.github/workflows/deny.yml @@ -16,4 +16,4 @@ jobs: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 with: persist-credentials: false - - uses: EmbarkStudios/cargo-deny-action@3fd3802e88374d3fe9159b834c7714ec57d6c979 # v2 + - uses: EmbarkStudios/cargo-deny-action@3fd3802e88374d3fe9159b834c7714ec57d6c979 # v2.0.15 diff --git a/.github/workflows/documentation.yml b/.github/workflows/documentation.yml index a06bd9332..e435d5fde 100644 --- a/.github/workflows/documentation.yml +++ b/.github/workflows/documentation.yml @@ -26,12 +26,12 @@ jobs: persist-credentials: false - name: Install protoc - uses: taiki-e/install-action@85b24a67ef0c632dfefad70b9d5ce8fddb040754 # v2 + uses: taiki-e/install-action@85b24a67ef0c632dfefad70b9d5ce8fddb040754 # v2.75.10 with: tool: protoc@3.20.3 - name: Install Rust - uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7 # master + uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1 with: toolchain: nightly-2026-02-26 @@ -41,7 +41,7 @@ jobs: node-version: 20 - name: Load cache - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2 + uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 with: save-if: ${{ github.ref == 'refs/heads/main' }} diff --git a/.github/workflows/upload_coverage.yml b/.github/workflows/upload_coverage.yml index 1a796a7fb..af3ceae33 100644 --- a/.github/workflows/upload_coverage.yml +++ b/.github/workflows/upload_coverage.yml @@ -67,7 +67,7 @@ jobs: persist-credentials: false - name: Upload coverage to Codecov - uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v5 + uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0 with: token: ${{ secrets.CODECOV_UPLOAD_TOKEN }} fail_ci_if_error: true diff --git a/.github/workflows/xtask.yml b/.github/workflows/xtask.yml index ffa7b330a..896b0aa83 100644 --- a/.github/workflows/xtask.yml +++ b/.github/workflows/xtask.yml @@ -57,7 +57,7 @@ jobs: echo "cachekey-${{ matrix.cachekey-id }}=xtask-${{ matrix.cachekey-id }}-${{ hashFiles('Cargo.toml', 'xtask/**') }}" >> $GITHUB_OUTPUT - name: Check xtask cache - uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5 + uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4 id: xtask-cache with: path: target/debug/xtask @@ -68,7 +68,9 @@ jobs: - name: Install Rust stable toolchain if: steps.xtask-cache.outputs.cache-hit != 'true' - uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7 # stable + uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1 + with: + toolchain: stable - name: Build if: steps.xtask-cache.outputs.cache-hit != 'true' diff --git a/.zizmor.yml b/.zizmor.yml new file mode 100644 index 000000000..77770f882 --- /dev/null +++ b/.zizmor.yml @@ -0,0 +1,3 @@ +rules: + unpinned-uses: + severity: high