Skip to content

Commit f69974d

Browse files
anakrishanakrish
authored
ci(dependabot): fix cargo workspace updates and refresh lockfiles (microsoft#629)
* ci(dependabot): fix cargo workspace updates and refresh lockfiles Remove nested Cargo workspace members from Dependabot's cargo directories to avoid manifest resolution failures during grouped updates. Add a Dependabot-only workflow that refreshes affected Cargo lockfiles, including the no_std target-specific resolution path, so CI can continue enforcing --locked and --frozen builds. Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com> * ci(dependabot): address workflow review comments Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com> * ci(dependabot): address workflow permission and toolchain comments Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com> * ci(dependabot): stage no-std lockfile refresh Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com> * ci(dependabot): harden refresh workflow * ci(dependabot): refine workflow gating and staging * ci(dependabot): harden workflow git operations --------- Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
1 parent 942dd47 commit f69974d

2 files changed

Lines changed: 129 additions & 3 deletions

File tree

‎.github/dependabot.yml‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -17,10 +17,7 @@ updates:
1717
- "/bindings/java"
1818
- "/bindings/python"
1919
- "/bindings/ruby"
20-
- "/bindings/ruby/ext/regorusrb"
2120
- "/bindings/wasm"
22-
- "/tests/ensure_no_std"
23-
- "/xtask"
2421
schedule:
2522
interval: "weekly"
2623
commit-message:

‎.github/workflows/dependabot-refresh-cargo-lockfiles.yml‎

Lines changed: 129 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,129 @@
1+
# Copyright (c) Microsoft Corporation. All rights reserved.
2+
#
3+
name: dependabot/refresh-cargo-lockfiles
4+
5+
on:
6+
pull_request_target:
7+
types: [opened, synchronize, reopened]
8+
branches: ["main"]
9+
10+
concurrency:
11+
group: dependabot-refresh-cargo-lockfiles-${{ github.event.pull_request.number }}
12+
cancel-in-progress: true
13+
14+
permissions:
15+
contents: read
16+
17+
env:
18+
CARGO_TERM_COLOR: always
19+
20+
jobs:
21+
refresh-cargo-lockfiles:
22+
permissions:
23+
contents: write
24+
if: >-
25+
github.event.pull_request.user.login == 'dependabot[bot]' &&
26+
github.event.pull_request.head.repo.full_name == github.repository
27+
runs-on: ubuntu-latest
28+
29+
steps:
30+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
31+
with:
32+
repository: ${{ github.event.pull_request.head.repo.full_name }}
33+
ref: ${{ github.event.pull_request.head.ref }}
34+
fetch-depth: 0
35+
persist-credentials: false
36+
37+
- name: Setup Rust toolchain
38+
run: |
39+
rustup toolchain install 1.92.0 --profile minimal
40+
rustup override set 1.92.0
41+
cargo --version
42+
rustc --version
43+
44+
- name: Refresh affected Cargo lockfiles
45+
shell: bash
46+
run: |
47+
set -euo pipefail
48+
49+
base_sha="${{ github.event.pull_request.base.sha }}"
50+
head_sha="${{ github.event.pull_request.head.sha }}"
51+
52+
mapfile -t changed_files < <(git diff --name-only "$base_sha" "$head_sha" -- ':(glob)**/Cargo.toml' ':(glob)**/Cargo.lock')
53+
54+
if [ "${#changed_files[@]}" -eq 0 ]; then
55+
echo "No Cargo manifest or lockfile changes detected."
56+
exit 0
57+
fi
58+
59+
declare -A manifests=()
60+
for path in "${changed_files[@]}"; do
61+
case "$path" in
62+
bindings/ffi/*)
63+
manifests["bindings/ffi/Cargo.toml"]=1
64+
;;
65+
bindings/java/*)
66+
manifests["bindings/java/Cargo.toml"]=1
67+
;;
68+
bindings/python/*)
69+
manifests["bindings/python/Cargo.toml"]=1
70+
;;
71+
bindings/ruby/*)
72+
manifests["bindings/ruby/Cargo.toml"]=1
73+
;;
74+
bindings/wasm/*)
75+
manifests["bindings/wasm/Cargo.toml"]=1
76+
;;
77+
*)
78+
manifests["Cargo.toml"]=1
79+
;;
80+
esac
81+
done
82+
83+
for manifest in "${!manifests[@]}"; do
84+
echo "Refreshing lockfile for $manifest"
85+
cargo metadata \
86+
--config build.rustc="rustc" \
87+
--config build.rustc-wrapper="" \
88+
--config build.rustc-workspace-wrapper="" \
89+
--format-version 1 \
90+
--all-features \
91+
--manifest-path "$manifest" > /dev/null
92+
done
93+
94+
if [[ -n "${manifests[Cargo.toml]+x}" ]]; then
95+
echo "Refreshing lockfile for tests/ensure_no_std/Cargo.toml (thumbv7m-none-eabi)"
96+
cargo metadata \
97+
--config build.rustc="rustc" \
98+
--config build.rustc-wrapper="" \
99+
--config build.rustc-workspace-wrapper="" \
100+
--format-version 1 \
101+
--manifest-path tests/ensure_no_std/Cargo.toml \
102+
--filter-platform thumbv7m-none-eabi > /dev/null
103+
fi
104+
105+
- name: Commit lockfile refresh
106+
shell: bash
107+
env:
108+
GH_TOKEN: ${{ github.token }}
109+
run: |
110+
set -euo pipefail
111+
112+
mapfile -t lockfiles < <(git ls-files -m -o --exclude-standard -- ':(glob)**/Cargo.lock')
113+
114+
for lockfile in "${lockfiles[@]}"; do
115+
git add "$lockfile"
116+
done
117+
118+
if git diff --cached --quiet; then
119+
echo "No Cargo lockfile changes required."
120+
exit 0
121+
fi
122+
123+
auth_header=$(printf 'x-access-token:%s' "$GH_TOKEN" | base64 | tr -d '\n')
124+
trap 'git config --unset-all http.https://github.com/.extraheader' EXIT
125+
git config http.https://github.com/.extraheader "AUTHORIZATION: basic ${auth_header}"
126+
git config user.name "github-actions[bot]"
127+
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
128+
git commit -m "build(deps): refresh Cargo lockfiles"
129+
git push origin HEAD:${{ github.event.pull_request.head.ref }}

0 commit comments

Comments
 (0)