chore(ci): bump the github-actions group with 3 updates by dependabot[bot] · Pull Request #2847 · everruns/bashkit

dependabot · 2026-11-06T00:18:47Z

Updates the requirements on dtolnay/rust-toolchain, pnpm/action-setup and taiki-e/install-action to permit the latest version.
Updates dtolnay/rust-toolchain to d86e0fa8f147d6539442c26a61ebba8becc19489

Commits

See full diff in compare view

Updates pnpm/action-setup from 6.1.0 to 6.1.1

Release notes

Sourced from pnpm/action-setup's releases.

v6.1.1

What's Changed

fix: refresh native bootstrap and test shared store reuse by @zkochan in pnpm/action-setup#293

fix: update pnpm 11 bootstrap to 11.28.10 by @rstacruz25 in pnpm/action-setup#292

chore: update pinned GitHub Actions by @deining in pnpm/action-setup#223

fix: skip saving missing cache directories by @zkochan in pnpm/action-setup#294

docs: clarify manifest-based version selection by @djmurphy32 in pnpm/action-setup#244

New Contributors

@rstacruz25 made their first contribution in pnpm/action-setup#292

@djmurphy32 made their first contribution in pnpm/action-setup#244

Full Changelog: pnpm/action-setup@v6.1.0...v6.1.1

Commits

73e4699 docs: clarify manifest-based version selection (#244)
c05d46d fix: skip saving missing cache directories (#294)
343d2b1 Bump GitHub action workflows (#223)
9a15f15 fix: update pnpm 11 bootstrap to 11.28.10 (#292)
7cf8c4c fix: refresh native bootstrap and test shared store reuse (#293)
See full diff in compare view

Updates taiki-e/install-action from 2.89.1 to 2.90.0

Release notes

Sourced from taiki-e/install-action's releases.

2.90.0

Add fallback: skip input option. This is similar to fallback: none but skip unsupported tools instead of error. (#2052)

Update vacuum@latest to 0.36.2.

Update release-plz@latest to 0.4.3.

Update bpf-linker@latest to 0.13.0.

Changelog

Sourced from taiki-e/install-action's changelog.

Changelog

All notable changes to this project will be documented in this file.

This project adheres to Semantic Versioning.

[Unreleased]

[2.90.1] - 2026-11-04

Update zizmor@latest to 1.32.0.

Update uv@latest to 0.13.7.

Update typos@latest to 1.52.0.

Update tombi@latest to 1.9.9.

Update syft@latest to 1.56.0.

Update mise@latest to 2026.11.0.

Update kache@latest to 2.0.0.

Update cargo-nextest@latest to 0.9.151.

[2.90.0] - 2026-11-03

Add fallback: skip input option. This is similar to fallback: none but skip unsupported tools instead of error. (#2052)

Update vacuum@latest to 0.36.2.

Update release-plz@latest to 0.4.3.

Update bpf-linker@latest to 0.13.0.

[2.89.1] - 2026-11-02

Install ld.mold symlink when installing mold on Linux. Previously, only mold binary was installed. (#2050, thanks @FirelightFlagboy)

Update parse-dockerfile@latest to 0.1.9.

Update parse-changelog@latest to 0.6.18.

Update cargo-minimal-versions@latest to 0.1.38.

... (truncated)

Commits

b80e2bb Release 2.90.0
eb7aa1c Add fallback: skip input option
c846932 Update zizmor manifest
29b5f80 Update vacuum@latest to 0.36.2
9787a83 Update uv manifest
8d24cc9 Update typos manifest
55b8476 Update tombi manifest
dcaca98 Update release-plz@latest to 0.4.3
ee94ee5 Update cargo-nextest manifest
8c19464 Update bpf-linker@latest to 0.13.0
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

Updates the requirements on [dtolnay/rust-toolchain](https://github.com/dtolnay/rust-toolchain), [pnpm/action-setup](https://github.com/pnpm/action-setup) and [taiki-e/install-action](https://github.com/taiki-e/install-action) to permit the latest version. Updates `dtolnay/rust-toolchain` to d86e0fa8f147d6539442c26a61ebba8becc19489 - [Release notes](https://github.com/dtolnay/rust-toolchain/releases) - [Commits](https://github.com/dtolnay/rust-toolchain/commits/d86e0fa8f147d6539442c26a61ebba8becc19489) Updates `pnpm/action-setup` from 6.1.0 to 6.1.1 - [Release notes](https://github.com/pnpm/action-setup/releases) - [Commits](pnpm/action-setup@ea17c68...73e4699) Updates `taiki-e/install-action` from 2.89.1 to 2.90.0 - [Release notes](https://github.com/taiki-e/install-action/releases) - [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md) - [Commits](taiki-e/install-action@682ce6c...b80e2bb) --- updated-dependencies: - dependency-name: dtolnay/rust-toolchain dependency-version: d86e0fa8f147d6539442c26a61ebba8becc19489 dependency-type: direct:production dependency-group: github-actions - dependency-name: pnpm/action-setup dependency-version: 6.1.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: taiki-e/install-action dependency-version: 2.90.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>

bashkit-pr-reviewer · 2026-11-06T00:19:53Z

Review summary (PR #2847)

Verdict: Safe to merge. Dependabot SHA-only bump group across 10 workflow files (+26/−26): dtolnay/rust-toolchain → d86e0fa8, pnpm/action-setup # v6.1.0 → # v6.1.1 (ea17c68d → 73e46992), taiki-e/install-action # v2 (682ce6c3 → b80e2bb2). No workflow logic, inputs, versions, or toolchain pins changed (nightly stays nightly-2026-10-30, pnpm with: version: inputs untouched). No findings at any severity.

Context checked beyond the diff: checked-out head in /workspace/bashkit; verified no old SHAs (ea17c68d…, 682ce6c3…, 5b842231…) remain under .github/; verified version comments still match the pinned refs; read AGENTS.md (no behavior change, so no knowledge/ update owed). Full diff was available (truncated: false), all 10 files reviewed; no Rust/sandbox code touched, so no threat-model or VFS review needed.

cloudflare-workers-and-pages · 2026-11-06T00:20:05Z

Deploying with Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	`16765db`	Commit Preview URL Branch Preview URL	Nov 06 2026, 12:20 AM

chaliy · 2026-11-06T01:02:44Z

Superseded by #2850 — this bump breaks the nightly jobs and cannot land as-is.

Root cause: the new dtolnay/rust-toolchain pin (d86e0fa) removed the toolchain: input (valid inputs are now only targets/target/components). The nightly jobs in python.yml, publish-python.yml, nightly.yml, fuzz.yml and ci.yml silently fall back to stable 1.96.0, so the Pyodide wheel fails with can't find crate for core (target never installed). #2850 keeps your other two bumps and installs the pinned nightlies explicitly via rustup toolchain install.

chaliy · 2026-11-06T01:09:32Z

Closed as superseded by #2850 (see root-cause note above). Reopen if #2850 fails to land.

#2850) The toolchain action dropped its `toolchain:` input and now always installs the rust-toolchain.toml toolchain, so the nightly jobs (Pyodide wheel, Miri, ASAN, fuzz) silently got stable 1.96.0 and the Pyodide wheel failed with "can't find crate for core". They now install their pinned nightly explicitly via `rustup toolchain install` and select it per command. Includes the pnpm and taiki-e action bumps from #2847, which it supersedes. `cargo install` does not follow a per-command selection, so that migration also moved both cargo-fuzz installs onto the pinned stable, where an unpinned source build resolves to the newest release and an upstream MSRV bump breaks an unchanged tree -- the cargo-geiger 0.14.0 failure test_pinned_ci_tools.py exists to prevent. The test read the nightly exemption per job, so a job that installed a nightly anywhere exempted every source build in it; it now reads per step, and covers bare `cargo install` run steps too. It also follows a `${{ env.X }}` indirection, without which the two Pyodide jobs read as non-nightly -- the very spelling the per-step opt-in uses. Separately, the nightly soak added in #2874 had never passed: it runs python_tenant_stress_tests at 300 rounds, where one test makes 3,000 exec() calls in a session capped at 1,000, so it died on that cap instead of on what it asserts. MAX_ROUNDS is now one constant behind both the round bound and the session headroom. Verified by dispatching nightly.yml and fuzz.yml on the branch rather than reasoning from YAML: the soak, Miri, AddressSanitizer, Security Analysis, Advisory Audit, all 9 fuzz targets and the Pyodide wheel all pass. Supersedes #2847.

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Nov 6, 2026

chaliy mentioned this pull request Nov 6, 2026

fix(ci): migrate nightly jobs to new dtolnay/rust-toolchain schema #2850

Merged

4 of 5 tasks

chaliy closed this Nov 6, 2026

Navigation Menu

Repository navigation

chore(ci): bump the github-actions group with 3 updates - #2847

chore(ci): bump the github-actions group with 3 updates#2847
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-b11a64cf0c

dependabot Bot commented on behalf of github Nov 6, 2026 •

edited by blacksmith-sh Bot

Loading

Uh oh!

bashkit-pr-reviewer Bot commented Nov 6, 2026

Uh oh!

cloudflare-workers-and-pages Bot commented Nov 6, 2026 •

edited

Loading

Uh oh!

chaliy commented Nov 6, 2026

Uh oh!

chaliy commented Nov 6, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Nov 6, 2026 • edited by blacksmith-sh Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v6.1.1

What's Changed

New Contributors

2.90.0

Changelog

[Unreleased]

[2.90.1] - 2026-11-04

[2.90.0] - 2026-11-03

[2.89.1] - 2026-11-02

Uh oh!

bashkit-pr-reviewer Bot commented Nov 6, 2026

Review summary (PR #2847)

Uh oh!

cloudflare-workers-and-pages Bot commented Nov 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Deploying with Cloudflare Workers

Uh oh!

chaliy commented Nov 6, 2026

Uh oh!

chaliy commented Nov 6, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Nov 6, 2026 •

edited by blacksmith-sh Bot

Loading

cloudflare-workers-and-pages Bot commented Nov 6, 2026 •

edited

Loading