Skip to content

chore: improve cargo cache#478

Merged
leekeiabstraction merged 3 commits intoapache:mainfrom
fresh-borzoni:fix/ci-cargo-cache
Apr 5, 2026
Merged

chore: improve cargo cache#478
leekeiabstraction merged 3 commits intoapache:mainfrom
fresh-borzoni:fix/ci-cargo-cache

Conversation

@fresh-borzoni
Copy link
Copy Markdown
Contributor

@fresh-borzoni fresh-borzoni commented Apr 5, 2026

Summary

closes #479

Fix Rust CI caching:
hashFiles('**/Cargo.lock') was always empty because Cargo.lock is gitignored, so every build compiled from scratch.
removed from .gitignore

@fresh-borzoni
Copy link
Copy Markdown
Contributor Author

@leekeiabstraction PTAL 🙏

@fresh-borzoni
Copy link
Copy Markdown
Contributor Author

@leekeiabstraction changed, PTAL

@fresh-borzoni
Copy link
Copy Markdown
Contributor Author

@leekeiabstraction fixed licenserc.yaml

@fresh-borzoni
Copy link
Copy Markdown
Contributor Author

Looks good, twice as fast for rust now

@leekeiabstraction
Copy link
Copy Markdown
Contributor

I ran a cargo audit to check for CVEs. Both of these traced back to testcontainers 0.25.2 as the common ancestor

  Crate:     astral-tokio-tar                                                                                                                                                       
  Version:   0.5.6                                                                                                                                                                  
  Title:     Insufficient validation of PAX extensions during extraction                                                                                                            
  Date:      2026-03-17                                                                                                                                                             
  ID:        RUSTSEC-2026-0066                                                                                                                                                      
  URL:       https://rustsec.org/advisories/RUSTSEC-2026-0066                                                                                                                       
  Severity:  1.7 (low)                                                                                                                                                              
  Solution:  Upgrade to >=0.6.0
  Dependency tree:                                                                                                                                                                  
  astral-tokio-tar 0.5.6
  └── testcontainers 0.25.2                                                                                                                                                         
      └── fluss-rs 0.2.0                                                                                                                                                            
          ├── fluss_python 0.2.0
          ├── fluss-examples 0.2.0                                                                                                                                                  
          └── fluss-cpp 0.2.0
                                                                                                                                                                                    
  Crate:     rustls-pemfile
  Version:   2.2.0                                                                                                                                                                  
  Warning:   unmaintained
  Title:     rustls-pemfile is unmaintained
  Date:      2025-11-28                                                                                                                                                             
  ID:        RUSTSEC-2025-0134
  URL:       https://rustsec.org/advisories/RUSTSEC-2025-0134                                                                                                                       
  Dependency tree:                                                                                                                                                                  
  rustls-pemfile 2.2.0
  └── bollard 0.19.4                                                                                                                                                                
      └── testcontainers 0.25.2                                                                                                                                                     
          └── fluss-rs 0.2.0
              ├── fluss_python 0.2.0                                                                                                                                                
              ├── fluss-examples 0.2.0
              └── fluss-cpp 0.2.0
                                                                                                                                                                                    
  error: 1 vulnerability found!
  warning: 1 allowed warning found                                                                                                                                                                                                                                                                                

@leekeiabstraction
Copy link
Copy Markdown
Contributor

Raised issue for CVEs scanning: #480

@fresh-borzoni
Copy link
Copy Markdown
Contributor Author

we need to fix this as well: #481

@leekeiabstraction
Copy link
Copy Markdown
Contributor

Approved, TY for the PR

@leekeiabstraction leekeiabstraction merged commit c2c4ec7 into apache:main Apr 5, 2026
8 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[ci] fix ineffective Rust build caching

2 participants