Skip to content

ci: Update Github Actions (libc-0.2) - #5644

Open
renovate-bot wants to merge 1 commit into
rust-lang:libc-0.2from
renovate-bot:renovate/libc-0.2-github-actions
Open

ci: Update Github Actions (libc-0.2)#5644
renovate-bot wants to merge 1 commit into
rust-lang:libc-0.2from
renovate-bot:renovate/libc-0.2-github-actions

Conversation

@renovate-bot

@renovate-bot renovate-bot commented Oct 19, 2026 •
edited by rustbot
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Type Update Change
Swatinem/rust-cache action patch v2.9.2 → v2.9.3
release-plz/action action patch v0.5.141 → v0.5.148
taiki-e/install-action action minor v2.87.27 → v2.90.1
vmactions/netbsd-vm action patch v1.5.2 → v1.5.3
vmactions/omnios-vm action patch v1.3.7 → v1.3.8
vmactions/solaris-vm action patch v1.4.1 → v1.4.2
zizmorcore/zizmor-action action minor v0.6.4 → v0.8.1

Release Notes

Swatinem/rust-cache

v2.9.3

Compare Source

What's Changed
New Contributors

Full Changelog: Swatinem/rust-cache@v2.9.2...v2.9.3

release-plz/action

v0.5.148

Compare Source

What's Changed

Full Changelog: release-plz/action@v0.5.147...v0.5.148

v0.5.147

Compare Source

What's Changed

Full Changelog: release-plz/action@v0.5.146...v0.5.147

v0.5.146

Compare Source

What's Changed

Full Changelog: release-plz/action@v0.5.145...v0.5.146

v0.5.145

Compare Source

What's Changed

Full Changelog: release-plz/action@v0.5.144...v0.5.145

v0.5.144

Compare Source

What's Changed

Full Changelog: release-plz/action@v0.5.143...v0.5.144

v0.5.143

Compare Source

What's Changed

Full Changelog: release-plz/action@v0.5.142...v0.5.143

v0.5.142

Compare Source

What's Changed

Full Changelog: release-plz/action@v0.5.141...v0.5.142

taiki-e/install-action

v2.90.1: 2.90.1

Compare Source

  • Update zizmor@latest to 1.32.0.

  • Update uv@latest to 0.13.7.

  • Update typos@latest to 1.52.0.

  • Update tombi@latest to 1.9.9.

  • Update syft@latest to 1.56.0.

  • Update mise@latest to 2026.11.0.

  • Update kache@latest to 2.0.0.

  • Update cargo-nextest@latest to 0.9.151.

v2.90.0: 2.90.0

Compare Source

  • Add fallback: skip input option. This is similar to fallback: none but skip unsupported tools instead of error. (#​2052)

  • Update vacuum@latest to 0.36.2.

  • Update release-plz@latest to 0.4.3.

  • Update bpf-linker@latest to 0.13.0.

v2.89.1: 2.89.1

Compare Source

  • Install ld.mold symlink when installing mold on Linux. Previously, only mold binary was installed. (#​2050, thanks @​FirelightFlagboy)

  • Update parse-dockerfile@latest to 0.1.9.

  • Update parse-changelog@latest to 0.6.18.

  • Update cargo-minimal-versions@latest to 0.1.38.

  • Update cargo-hack@latest to 0.6.46.

v2.89.0: 2.89.0

Compare Source

  • Support yq. (#​2036, thanks @​FirelightFlagboy)

  • Support mold. (#​2044, thanks @​FirelightFlagboy)

  • Fix an error when old cargo-binstall had already been installed at non-standard location. (#​2048)

  • Update wasm-tools@latest to 1.263.0.

  • Update wasm-pack@latest to 0.15.1.

  • Update wasm-bindgen@latest to 0.2.130.

  • Update vacuum@latest to 0.36.1.

  • Update prek@latest to 0.5.9.

  • Update mise@latest to 2026.10.25.

  • Update kingfisher@latest to 2.16.0.

  • Update cargo-binstall@latest to 1.26.2.

v2.88.1: 2.88.1

Compare Source

  • Update wasmtime@latest to 50.0.1.

  • Update vacuum@latest to 0.36.0.

  • Update tombi@latest to 1.9.8.

  • Update mise@latest to 2026.10.23.

  • Update kingfisher@latest to 2.15.0.

  • Update espup@latest to 0.19.0.

  • Update deepsource@latest to 0.10.2.

  • Update biome@latest to 2.6.4.

v2.88.0: 2.88.0

Compare Source

v2.87.33: 2.87.33

Compare Source

  • Update vacuum@latest to 0.35.4.

  • Update uv@latest to 0.13.6.

  • Update trunk@latest to 0.22.1.

  • Update tombi@latest to 1.9.6.

  • Update release-plz@latest to 0.4.2.

  • Update mise@latest to 2026.10.21.

  • Update cargo-nextest@latest to 0.9.150.

  • Update cargo-about@latest to 0.9.3.

v2.87.32: 2.87.32

Compare Source

  • Update wild@latest to 0.11.0.

  • Update vacuum@latest to 0.35.2.

  • Update tombi@latest to 1.9.5.

  • Update sccache@latest to 0.19.0.

  • Update release-plz@latest to 0.4.1.

  • Update mise@latest to 2026.10.19.

  • Update knope@latest to 0.23.2.

  • Update dprint@latest to 0.64.3.

  • Update cargo-vet@latest to 0.10.3.

  • Update cargo-sort@latest to 2.1.4.

  • Update cargo-binstall@latest to 1.26.1.

  • Update biome@latest to 2.6.3.

v2.87.31: 2.87.31

Compare Source

  • Downgrade cargo-sort@latest to 2.1.3.

  • Update vacuum@latest to 0.35.0.

  • Update xh@latest to 0.26.3.

  • Update uv@latest to 0.13.5.

  • Update ubi@latest to 0.13.0.

  • Update trivy@latest to 0.76.1.

  • Update tombi@latest to 1.9.0.

  • Update release-plz@latest to 0.3.174.

  • Update prek@latest to 0.5.7.

  • Update mise@latest to 2026.10.17.

  • Update jaq@latest to 3.1.2.

  • Update espup@latest to 0.17.1.

  • Update cargo-zigbuild@latest to 0.24.0.

  • Update cargo-nextest@latest to 0.9.149.

  • Update biome@latest to 2.6.2.

v2.87.30: 2.87.30

Compare Source

  • Update zizmor@latest to 1.31.1.

  • Update wasmtime@latest to 50.0.0.

  • Update vacuum@latest to 0.33.2.

  • Update uv@latest to 0.13.4.

  • Update trunk@latest to 0.22.0.

  • Update tombi@latest to 1.8.9.

  • Update syft@latest to 1.55.0.

  • Update release-plz@latest to 0.3.173.

  • Update prek@latest to 0.5.6.

  • Update mise@latest to 2026.10.15.

  • Update knope@latest to 0.23.1.

  • Update kingfisher@latest to 2.14.0.

  • Update kache@latest to 1.2.2.

  • Update dprint@latest to 0.64.1.

  • Update cosign@latest to 3.1.4.

  • Update cargo-crap@latest to 0.9.0.

  • Update cargo-binstall@latest to 1.26.0.

v2.87.29: 2.87.29

Compare Source

  • Update zizmor@latest to 1.31.0.

  • Update wasmtime@latest to 49.0.3.

  • Update wasm-tools@latest to 1.262.0.

  • Update uv@latest to 0.13.1.

  • Update trivy@latest to 0.76.0.

  • Update tombi@latest to 1.8.4.

  • Update release-plz@latest to 0.3.172.

  • Update osv-scanner@latest to 2.7.0.

  • Update mise@latest to 2026.10.11.

  • Update mdbook-d2@latest to 0.3.9.

  • Update kingfisher@latest to 2.13.0.

  • Update kache@latest to 1.2.1.

  • Update just@latest to 1.59.0.

  • Update dprint@latest to 0.63.0.

  • Update cargo-crap@latest to 0.8.0.

  • Update bpf-linker@latest to 0.12.0.

v2.87.28: 2.87.28

Compare Source

  • Update dprint@latest to 0.62.0.

  • Update vacuum@latest to 0.33.0.

  • Update uv@latest to 0.13.0.

  • Update tombi@latest to 1.8.1.

  • Update release-plz@latest to 0.3.171.

  • Update rclone@latest to 1.75.2.

  • Update mise@latest to 2026.10.7.

  • Update cargo-binstall@latest to 1.25.3.

vmactions/netbsd-vm

v1.5.3

Compare Source

NetBSD 11.1, now the default release

NetBSD 11.1 is supported on x86_64, aarch64, riscv64 and sparc64, and
as 11.1-microvm, from image builder 2.2.9, which also rebuilds 10.x and
11.0. 11.1 is now the default when release is omitted (it was 11.0).
It ships on the same four architectures as 11.0, so the default move
drops no architecture. To stay on 11.0:

  • uses: vmactions/netbsd-vm@&rust-lang/libc#8203;v1
    with:
    release: "11.0"

The leading-part form follows: release: "11" now picks 11.1, the
newest 11.x, on every architecture.

11.1 has the same sync methods as 11.0: rsync, scp, sshfs, nfs and tar
on x86_64, aarch64 and riscv64; scp, sshfs, nfs and tar on sparc64,
where scp is the default; rsync, scp, sshfs and tar on 11.1-microvm.

The test matrix runs on ubuntu-26.04 and ubuntu-26.04-arm and covers
10.0, 10.1, 10.2, 11.0, 11.1, 11.0-microvm and 11.1-microvm: 91 of 92
jobs pass, all 19 new 11.1 jobs among them, and the 9p job is skipped
as before. It has fewer jobs than v1.5.2's 245 because 9.x left the
matrix (see below) and legs that repeated the same check were dropped:
disable-cache and the custom shell test now run once, on the default
release, and nfs, scp and sshfs run aarch64 only on the arm runner.

9.x leaves the test matrix

NetBSD 9 has reached end-of-life, and no public mirror lists 9.x
x86_64 packages any more (cdn.NetBSD.org, ftp.NetBSD.org,
ftp.fr.NetBSD.org, ftp.jaist.ac.jp, ftp.allbsd.org), so pkg_add can no
longer install anything there. The test matrix therefore no longer runs
9.0 - 9.5. The 9.x images are still available, and release: "9.5" and
the others boot as before; they stay on builder 2.2.7, the last one
that built them.

Fixed: non-root guest users can write the nfs share

With sync: nfs, only guest root was mapped to the runner user. Any
other guest account kept its own uid and could write the synced folder
only if that uid happened to be the runner's (1001). anyvm 0.7.4
squashes every guest uid to the runner user, so a build that runs as an
unprivileged account (useradd test; su test -c make) can now write the
share, and the files it creates are owned by the runner user on the
host. The x86_64 nfs jobs now check this on every release:
https://github.com/anyvm-org/anyvm/releases/tag/v0.7.4

Because every guest user, root included, is the runner user on the
share, chown and chgrp on files in it fail with "Operation not
permitted". If your build needs them, use rsync, scp or tar, which put
the files on the VM's own disk.

New input: cache-after-prepare-key-suffix

Optional, empty by default. With cache-after-prepare: true, the
prepared VM image was keyed only on the prepare script and the sync
method, so a change to a script that prepare runs from your repository
did not rebuild it, and there was no way to throw it away by hand
(vmactions/freebsd-vm#167). A non-empty value is appended to that key,
so changing it makes the next run start from the base image and run
prepare again, for example:

cache-after-prepare-key-suffix: deps-${{ hashFiles('ci/deps.sh') }}

Only an exact key match restores a prepared image, so a run without a
suffix never picks up an entry saved with one.

Pins

BUILDER_VERSION 2.2.7 -> 2.2.9 for 10.x and 11.0; 2.2.9 for 11.1;
2.2.7 for 9.x (unchanged)
ANYVM_VERSION 0.7.2 -> 0.7.5

The builder version is part of the image cache key, so the first run
on any release but 9.x downloads a new image, and with
cache-after-prepare it runs prepare once more.

vmactions/omnios-vm

v1.3.8

Compare Source

OmniOS r151060, now the default release

r151060 and r151060-build are new, installed from the official
omnios-r151060.iso, and r151060 is now the default when release is
omitted (it was r151058). r151060 is a stable release, supported until
2027-11-01. As with r151058, the -build image adds build-essential,
and both support the rsync, scp, nfs and tar sync methods. The older
releases are still available; builder 2.1.4 rebuilt them with no
recipe changes. OmniOS stays x86_64 only, so the default move drops no
architecture.

The test matrix runs on ubuntu-26.04 runners across r151046 to
r151060: 47 of 49 jobs pass; the 9p and sshfs jobs are skipped as
before. It has fewer jobs than v1.3.7's 62 because legs that repeated
the same check were dropped: disable-cache and the custom shell test
now run once, on the default release.

New input: cache-after-prepare-key-suffix

vmactions/freebsd-vm#167: with cache-after-prepare: true, the prepared
VM image was keyed only on the prepare script and the sync method, so
there was no way to throw it away by hand. The new optional input is
appended to that cache key; change its value and the next run starts
from the base image and runs prepare again. Empty, the default, keeps
the key and your existing caches as they are. Only an exact key match
restores a prepared image, so a run without a suffix never picks up an
entry saved with one.

Fixed: non-root guest users can write the nfs share

With sync: nfs, only guest root was mapped to the runner user. Any
other guest account kept its own uid and could write the synced folder
only if that uid happened to be the runner's (1001). anyvm 0.7.4
squashes every guest uid to the runner user, so a build that runs as an
unprivileged account (useradd test; su test -c make) can now write the
share, and the files it creates are owned by the runner user on the
host. The nfs test jobs now check this on every release:
https://github.com/anyvm-org/anyvm/releases/tag/v0.7.4

Because every guest user, root included, is the runner user on the
share, chown and chgrp on files in it fail with "Operation not
permitted". If your build needs them, use rsync, scp or tar, which put
the files on the VM's own disk.

Pins

BUILDER_VERSION 2.1.3 -> 2.1.4
ANYVM_VERSION 0.7.2 -> 0.7.5

vmactions/solaris-vm

v1.4.2

Compare Source

Solaris: non-root users can write the nfs-synced folder

The runtime moves to anyvm 0.7.4, whose nfs fix is the reason for this
release: https://github.com/anyvm-org/anyvm/releases/tag/v0.7.4
On ubuntu-26.04 runners 23 of 25 test jobs pass; the 9p and sshfs jobs
are skipped as before.

Fixed: non-root users could not write the nfs share

#​70: with sync: nfs, a build run as an ordinary
user created in the guest failed with "Permission denied", while the
same workflow worked on FreeBSD. The nfs export mapped only guest root
to the runner user; any other guest account kept its own uid and met
the runner-owned workspace as "other". FreeBSD worked by coincidence:
its first pw useradd hands out uid 1001, the GitHub runner's own uid.
Solaris useradd hands out 1000.

anyvm 0.7.4 now maps every guest uid to the runner user: the kernel nfs
export of a Linux runner gets all_squash, and on other hosts the
user-space nfsd 0.1.1 runs with -all_squash. Files any guest user
creates are owned by the runner user on the host, as files from guest
root already were. Nothing to change in your workflow.

The test matrix now checks this on every release: a guest user with
uid 4321 creates, appends to and renames a file in the share, and the
runner checks its content and that the runner user owns it.

New input: cache-after-prepare-key-suffix

Optional, empty by default. A non-empty value is appended to the
cache-after-prepare key, so changing it rebuilds the prepared image.
Use it when prepare runs a script from your repository, which the key
does not cover (vmactions/freebsd-vm#167), for example:

cache-after-prepare-key-suffix: deps-${{ hashFiles('ci/deps.sh') }}

Existing prepared-image caches stay valid when the input is not set.

Pins

BUILDER_VERSION 2.0.8 (unchanged)
ANYVM_VERSION 0.7.2 -> 0.7.4

zizmorcore/zizmor-action

v0.8.1

Compare Source

Sponsorship is appreciated!

zizmor 1.32 is now the default version used by this action.

Full release notes: https://docs.zizmor.sh/release-notes/#​1320

Full Changelog: zizmorcore/zizmor-action@v0.8.0...v0.8.1

v0.8.0

Compare Source

The action now supports prereleases.

The default has not changed, but you can pass a prerelease version
of zizmor or version: prerelease to get whatever latest
prerelease the action knows about.

What's Changed

Full Changelog: zizmorcore/zizmor-action@v0.7.1...v0.8.0

v0.7.1

Compare Source

zizmor changes

Bug Fixes 🐛🔗

  • Fixed a regression in 1.31.0 where some ignore comments/configurations would no longer apply to the dangerous-triggers audit

action changes

The default version of zizmor is now 1.31.1.

What's Changed

Full Changelog: zizmorcore/zizmor-action@v0.7.0...v0.7.1

v0.7.0

Compare Source

Sponsorship is appreciated!

zizmor notes
Enhancements 🌱🔗

  • The typosquat-uses audit now supports pre-commit config inputs (#​2437)

  • The self-hosted-runner audit is now significantly more precise (#​2350)

    Many thanks to @​ubiratansoares for proposing and implementing this enhancement!

  • The dangerous-triggers audit now considers the issue_comment trigger fundamentally dangerous (#​2396)

  • zizmor is now aware of the image_version workflow trigger (#​2397)

  • The dangerous-triggers audit now produces more precise finding/diagnostic spans (#​2402)

  • The cache-poisoning audit is now aware of pnpm/setup (#​2409)

  • The unpinned-images audit now produces more precise findings when the user's workflow contains an indirect matrix (#​2395)

    Many thanks to @​ubiratansoares for proposing and implementing this enhancement!

  • The cache-poisoning audit is now aware of GitHub's new cache-mode: setting, and will skip any findings that would occur when a job has an effective cache-mode: none (#​2418)

  • The cache-poisoning audit now flags usages of cache-mode: write and cache-mode: write-only with dangerous triggers, i.e. triggers that give an attacker privileged code execution (#​2426)

  • zizmor now uses a tree-sitter grammar for PowerShell that's more precise/capable of capturing more non-trivial PowerShell expressions (#​2444)

Bug Fixes 🐛🔗

  • Fixed a class of false positives/imprecisions in adhoc-packages that caused some pnpm and yarn invocations to be misclassified as package installations (#​2386)

    Many thanks to @​marcalexiei for implementing this improvement!

  • Fixed a bug where zizmor would fail to honor Git submodules and worktrees when discovering configuration files relative to a repo root (#​2390)

  • Fixed a bug where the ref-version-mismatch audit would crash on unusually placed version comments (#​2394)

  • Fixed a bug where zizmor would fail to handle some pre-commit inputs that use prek extensions to the language_version and default_language_version keys (#​2413)

  • Fixed a bug where the use-trusted-publishing audit would fail to detect certain true-positive patterns inside of PowerShell blocks (#​2444)

action notes
What's Changed
New Contributors

Full Changelog: zizmorcore/zizmor-action@v0.6.4...v0.7.0

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • On day 1 through 7 and 15 through 21 of the month, and on Monday (* * 1-7,15-21 * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@rustbot rustbot added A-CI Area: CI-related items S-waiting-on-review labels Oct 19, 2026
@rustbot

rustbot commented Oct 19, 2026

Copy link
Copy Markdown
Collaborator

⚠️ Warning ⚠️

  • Pull requests are usually filed against the main branch for this repo, but this one is against libc-0.2. Please double check that you specified the right target!

@renovate-bot
renovate-bot force-pushed the renovate/libc-0.2-github-actions branch 8 times, most recently from 2fa556a to f128f89 Compare October 26, 2026 22:03
@renovate-bot
renovate-bot force-pushed the renovate/libc-0.2-github-actions branch 6 times, most recently from a0ecb9d to cc321fc Compare November 3, 2026 03:38
@renovate-bot
renovate-bot force-pushed the renovate/libc-0.2-github-actions branch 2 times, most recently from 2bfb806 to 62adc08 Compare November 4, 2026 00:03
@renovate-bot
renovate-bot force-pushed the renovate/libc-0.2-github-actions branch from 62adc08 to ec0fca2 Compare November 4, 2026 18:53

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

A-CI Area: CI-related items S-waiting-on-review

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@renovate-bot @rustbot