Repository navigation
chore(deps): patched rustls-webpki, clipboard-win, vite, markdown-it and test tooling clear every advisory check - #72
Merged
Conversation
…n test and lint advisories
…and test tooling clear every advisory check
…clipboard-win and rustls-webpki
rgdevment
changed the title
This was referenced Oct 27, 2026
rgdevment
added a commit
that referenced
this pull request
Nov 3, 2026
…t a branch never touched, as Tisty does (#84) Brings over what Tisty's `main` learnt since LinkUnbound last copied its pipelines (up to Tisty #548), without overwriting what LinkUnbound already does better: `pre-push` checking each pushed commit's tree, `--landed` over the whole push range, and `news.sh` reading the pushed `news.json`. ## What changed ### Hooks and scripts - **Branch names.** `scripts/commits.sh --branch` checks that a branch is named `kind/what`, where the kind is a commit type, `hotfix` or `release` (for example `feat/picker-tiles`). - `pre-commit` runs it on the branch being committed on. - `pre-push` runs it on the name the branch takes on the remote. - Only `main`, a detached HEAD and GitHub's `dependabot/*` are exempt. Deleting a remote branch is still allowed. - **One-line commits.** `commit-msg` refuses any line under the subject. It still folds a subject the editor wrapped into one line, and it lets `Revert "`, `fixup!`, `squash!`, `amend!` and merges through. - `commits.sh` checks the body of each commit on a branch, except Dependabot's. - It does not check bodies with `--landed` on `main`, because a squash carries the pull request's body. - **Subject length.** A commit subject leaves room for the ` (#N)` GitHub adds on squash: up to 112 characters. Titles are still checked at 120, number included. - **`pre-push` remote.** It compares against the `main` of the remote being pushed to, not a fixed `origin/main`. - **Notices in `pre-commit`.** When a lockfile is staged, `pre-commit` writes the third-party notices again, so a stale one is one `git add` away. - **`rules.sh`** no longer walks `.claude/` or `vendor/` when it looks for Markdown. ### CI - **`ci.yml`** - A `changes` job decides whether the branch touched Rust. When it did not, `test` and both coverage jobs skip their Rust work. `app/src/news.json` counts as Rust, because the resident embeds it. - The new `tests` job reports for the test matrix. A matrix that is skipped never reports its names, so a required check on those names would wait forever. - On Windows the tests run on a trusted ReFS Dev Drive, with `CARGO_PROFILE_DEV_DEBUG: line-tables-only`. `scripts/sidecar.sh` now honours `CARGO_TARGET_DIR` for this. - `coverage` no longer runs on Dependabot pull requests. `coverage-mac` and `sonar` already skipped them. - `sonar` runs when `coverage-mac` was skipped, so Sonar still reads the picker. - cargo-deny is split in two. `bans licenses sources` blocks. `advisories` and both `npm audit` steps only warn on a pull request, and still fail on `main`. - **`caches.yml`.** A new `stop` job cancels the runs still going for a closed pull request's last commit. - **`rules.yml`** - zizmor runs `--offline` on pull requests. The online pass, which checks the pinned actions for known vulnerabilities, runs only on the schedule and on a manual run, with three tries. - A new `advisories` job runs every day. When something in the lock has an advisory or a yank, it moves only the crates named, regenerates the notices and pushes `fix/advisories`. The run ends red on purpose, so it reaches the inbox. ## Why - An advisory published one morning turned every unrelated pull request red, and #72, #75 and #76 were each a hand fix for exactly that. - A pull request that only touches docs or the picker paid for the Windows and macOS suites and both coverage jobs. - Branch names and commit bodies were not checked, even though both are public from the first push. ## How it was checked - **`commits.sh --branch`** passed `feat/picker-tiles`, `fix/advisories`, `ci/tisty-pipelines`, `hotfix/a`, `release/2.9`, `dependabot/…`, `main` and `HEAD`. It refused `claude/…`, `rgdevment/feat-x`, `wip/algo`, `Feat/X` and `docs-languages`. - **`commit-msg`** passed a single line, a wrapped subject, a revert with its body and a fixup. It refused a subject with a body under it. - **`pre-push`** was fed simulated push lines: - it passed `feat/x`, a deletion, and a push straight to a URL; - it refused `wip/algo`. - **Subject length:** 113 characters is refused as a subject and passes as a title. In a range, `4945100` (a squash with a body) is refused, and passes with `--landed`. - **Static checks:** every workflow and action parses with `js-yaml`. `markdownlint` finds nothing in `CONTRIBUTING.md`. `bash -n` passes on every hook and script, and `scripts/rules.sh` is green. - **Not run locally:** actionlint and zizmor. The Rules job runs them on this pull request. ## For the reviewer - **The required checks need to change once this pull request has reported `tests`.** Replace `test / windows-latest` and `test / macos-latest` with `tests` in the Default ruleset. Until then, a pull request that does not touch Rust stays blocked on those two names. - **The Dev Drive moves the Windows target directory.** The Windows cache misses once after this lands. - **`rgdevment/...` and `claude/...` branches no longer pass `pre-commit` or `pre-push`.** Use `kind/what` instead.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes the Dependabot alerts for @vitest/mocker (#18, #19) and the markdown-it pulled in by markdownlint-cli2 (#7, #8, #10). Both are dev-only. The vite and app markdown-it alerts are covered by #70 and #69.