Files
Asmir Avdicevic c334d2da21 ci(secruity): ensure locked cargo files and dependabot cooldown (#788)
## Description

- Uses `--locked` to ensure we only use deps from the lock file
- Adds cooldown period to dependabot
- pins actions versions
- introduces zizimor and pinact

## Breaking Changes

<!-- Optional, if there are any breaking changes document them,
including how to migrate older code. -->

## Notes & open questions

<!-- Any notes, remarks or open questions you have to make about the -->
<!-- PR. -->

## Change checklist
<!-- Remove any that are not relevant. -->
- [ ] Self-review.
- [ ] Documentation updates following the [style
guide](https://rust-lang.github.io/rfcs/1574-more-api-documentation-conventions.html#appendix-a-full-conventions-text),
if relevant.
- [ ] Tests if relevant.
- [ ] All breaking changes documented.
- [ ] This PR was created by a human that thought critically about the
      proposed change and wrote an as clear and concise description as
      they could.
- [ ] This PR isn't slop, and is carefully crafted to do have the
      intented effect.
- [ ] `cargo make` passes locally.

---------

Co-authored-by: Friedel Ziegelmayer <me@dignifiedquire.com>
2026-08-20 14:00:43 +00:00

50 lines
1.3 KiB
YAML

# Run tests using the beta Rust compiler
name: Beta Rust
on:
schedule:
# 06:50 UTC every Monday
- cron: '50 4 * * 1'
workflow_dispatch:
concurrency:
group: beta-${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
# Default to read-only; jobs that need more grant it explicitly.
permissions:
contents: read
jobs:
tests:
uses: './.github/workflows/tests.yaml'
with:
rust-version: beta
notify:
timeout-minutes: 45
needs: tests
if: ${{ always() }}
runs-on: ubuntu-latest
steps:
- name: Extract test results
env:
NEEDS_JSON: ${{ toJSON(needs) }}
run: |
printf '%s\n' "$NEEDS_JSON"
result=$(echo "$NEEDS_JSON" | jq -r .tests.result)
echo TESTS_RESULT=$result
echo "TESTS_RESULT=$result" >>"$GITHUB_ENV"
- name: Notify discord on failure
uses: n0-computer/discord-webhook-notify@1399c1b2d57cc05894d506d2cfdc33c5f012b993 # v1.1.1
if: ${{ env.TESTS_RESULT == 'failure' }}
with:
severity: error
text: "Beta rust in **${{ github.repository }}**:"
details: |
Rustc beta tests failed
See https://github.com/${{ github.repository }}/actions/workflows/beta.yaml
webhookUrl: ${{ secrets.DISCORD_N0_GITHUB_CHANNEL_WEBHOOK_URL }}