Skip to content

Refactor CI to use cargo-zigbuild and split bindings workflow#689

Open
richarddd wants to merge 6 commits into
DelSkayn:masterfrom
richarddd:refactor/ci-zigbuild
Open

Refactor CI to use cargo-zigbuild and split bindings workflow#689
richarddd wants to merge 6 commits into
DelSkayn:masterfrom
richarddd:refactor/ci-zigbuild

Conversation

@richarddd
Copy link
Copy Markdown
Collaborator

Replaces the per-target apt and musl-cross toolchain installs with cargo-zigbuild, moves bindings regeneration into a dedicated workflow triggered by submodule or build-script changes, and drops the update-bindings branch trigger that caused self-triggering runs and wrong PR base branches.

Copy link
Copy Markdown
Collaborator

@Sytten Sytten left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

At some point it would be easier to use nix LOL

Comment thread .github/workflows/bindings.yml Outdated

- name: Set up zig
if: matrix.builder == 'zigbuild'
uses: mlugg/setup-zig@v2
Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

please pin rando actions

Comment thread .github/workflows/bindings.yml Outdated

- name: Install cargo-zigbuild
if: matrix.builder == 'zigbuild'
uses: taiki-e/install-action@v2
Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

same

Comment thread .github/workflows/bindings.yml Outdated

- name: Set up msys2
if: matrix.builder == 'msys2'
uses: msys2/setup-msys2@v2
Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

same

Addresses review feedback on PR DelSkayn#689: third-party actions are now pinned
to the upstream tag's commit SHA rather than mutable major-version tags,
preventing surprise upgrades or supply-chain attacks via tag rewrites.

Pinned (latest stable as of 2026-05):
- mlugg/setup-zig          v2.2.1   d1434d0
- taiki-e/install-action   v2.79.0  7be9fd8
- msys2/setup-msys2        v2.31.1  e989830

Applied in both bindings.yml and ci.yml where this PR added or moves the
action invocations.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants