deps #4
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Weekly `cargo update` PR — the other half of committing Cargo.lock | |
| # (blog.rust-lang.org/2023/08/29/committing-lockfiles): the committed lock pins | |
| # every build, and this job keeps that pin from fossilizing. It refreshes both | |
| # lockfiles (the root workspace and the docling-py bindings workspace), tests | |
| # the workspace against the latest compatible dependency versions right here | |
| # (the post's "run cargo update as part of a scheduled CI job"), and opens a | |
| # PR with the diff. CI on that PR (fmt/clippy, test --locked, msrv) is the | |
| # merge gate — a dependency that breaks the build or raises the MSRV floor | |
| # shows up red on the PR instead of as a release-day surprise. | |
| name: deps | |
| on: | |
| schedule: | |
| - cron: "17 4 * * 1" # Mondays 04:17 UTC | |
| workflow_dispatch: | |
| permissions: | |
| contents: write # push the deps/cargo-update branch | |
| pull-requests: write # open/refresh the update PR | |
| jobs: | |
| # Weekly known-CVE scan of the committed lockfiles. Runs unconditionally | |
| # (not gated on a lockfile change): an advisory can be published against a | |
| # version we already pin, so the value is auditing the *current* tree every | |
| # week, independent of whether `cargo update` moved anything. A finding fails | |
| # the job — the scheduled-run failure is the alarm, same philosophy as the | |
| # in-job test below. | |
| audit: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Install Rust (stable) | |
| run: | | |
| rustup toolchain install stable --profile minimal | |
| rustup default stable | |
| - uses: actions/cache@v4 | |
| with: | |
| path: | | |
| ~/.cargo/bin | |
| ~/.cargo/registry/index | |
| ~/.cargo/registry/cache | |
| key: ${{ runner.os }}-cargo-audit-bin | |
| - name: Install cargo-audit | |
| # --locked: cargo-audit's own deps have raised the MSRV past stable's | |
| # floor before; pin to its committed lockfile to install reliably. | |
| run: cargo install cargo-audit --locked | |
| - name: Audit both lockfiles | |
| # Known-accepted advisories are ignored by ID so the job fails only on | |
| # NEW findings (an unfiltered audit would go red every week on the | |
| # residual and get tuned out). Keep this list in sync with the | |
| # "Known residual" section of docs/SECURITY.md; drop an entry the week | |
| # its upstream fix lands so a regression can't hide behind the ignore. | |
| # RUSTSEC-2026-0194 / -0195: quick-xml DoS, reachable only via | |
| # calamine's transitive 0.31 pin (XLSX). Our direct quick-xml is | |
| # >=0.41 (patched). Remove when calamine bumps quick-xml. | |
| run: | | |
| IGNORES="--ignore RUSTSEC-2026-0194 --ignore RUSTSEC-2026-0195" | |
| echo "::group::root workspace" | |
| cargo audit $IGNORES | |
| echo "::endgroup::" | |
| echo "::group::docling-py workspace" | |
| cargo audit $IGNORES --file crates/docling-py/Cargo.lock | |
| echo "::endgroup::" | |
| cargo-update: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| # Push with the admin PAT when it's configured: branches pushed with | |
| # the default GITHUB_TOKEN don't trigger workflows, so the update PR | |
| # would sit there with no CI verdict. | |
| token: ${{ secrets.RELEASE_PAT || github.token }} | |
| - name: Install Rust (stable) | |
| run: | | |
| rustup toolchain install stable --profile minimal | |
| rustup default stable | |
| - uses: actions/cache@v4 | |
| with: | |
| path: | | |
| ~/.cargo/registry/index | |
| ~/.cargo/registry/cache | |
| ~/.cargo/git/db | |
| target | |
| key: ${{ runner.os }}-cargo-deps-update-${{ hashFiles('**/Cargo.lock') }} | |
| restore-keys: ${{ runner.os }}-cargo-deps-update- | |
| - name: cargo update (both workspaces) | |
| id: update | |
| run: | | |
| { cargo update | |
| cargo update --manifest-path crates/docling-py/Cargo.toml | |
| } 2>&1 | tee /tmp/update.log | |
| if git diff --quiet -- Cargo.lock crates/docling-py/Cargo.lock; then | |
| echo "Lockfiles already at the latest compatible versions." | |
| echo "changed=false" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "changed=true" >> "$GITHUB_OUTPUT" | |
| fi | |
| # Test against the fresh resolution in-job, not only on the PR: this red | |
| # is the scheduled "latest deps broke us" alarm even if the PR's own CI | |
| # never runs (e.g. RELEASE_PAT missing). | |
| - name: Test with updated dependencies | |
| if: steps.update.outputs.changed == 'true' | |
| run: cargo test --workspace --locked | |
| - name: Open / refresh the update PR | |
| if: steps.update.outputs.changed == 'true' | |
| env: | |
| GH_TOKEN: ${{ secrets.RELEASE_PAT || github.token }} | |
| run: | | |
| git config user.name "github-actions[bot]" | |
| git config user.email "41898282+github-actions[bot]@users.noreply.github.com" | |
| git checkout -B deps/cargo-update | |
| git add Cargo.lock crates/docling-py/Cargo.lock | |
| git commit -m "chore(deps): weekly cargo update" | |
| # Rebase onto master as of *now*, not as of job start: GitHub diffs a | |
| # new branch against the current default branch, and if master gained | |
| # a .github/workflows/ change while this job ran, the push would be | |
| # rejected as a workflow update the token may not be allowed to make. | |
| # (The RELEASE_PAT still needs the `workflow` scope for the weeks | |
| # when the previous deps/cargo-update branch predates a workflow | |
| # change on master — the force-push then legitimately rewrites it.) | |
| git fetch origin master | |
| git rebase origin/master | |
| git push --force -u origin deps/cargo-update | |
| { | |
| echo "Scheduled \`cargo update\` of both committed lockfiles;" | |
| echo "the workspace test suite passed against the new resolution." | |
| echo | |
| echo "<details><summary>cargo update log</summary>" | |
| echo | |
| echo '```' | |
| head -c 60000 /tmp/update.log | |
| echo '```' | |
| echo | |
| echo "</details>" | |
| } > /tmp/pr-body.md | |
| # One rolling PR: force-pushing the branch refreshes an open PR in | |
| # place; create only when none is open. | |
| if [ -z "$(gh pr list --head deps/cargo-update --state open --json number --jq '.[].number')" ]; then | |
| gh pr create \ | |
| --title "chore(deps): weekly cargo update" \ | |
| --body-file /tmp/pr-body.md | |
| else | |
| gh pr edit deps/cargo-update --body-file /tmp/pr-body.md | |
| fi |