chore(ci): pin Rust toolchain, mirror RSA advisory, gate dead code#1509
Merged
chore(ci): pin Rust toolchain, mirror RSA advisory, gate dead code#1509
Conversation
Same-day rustc 1.95 release broke CI. Pin rust-toolchain.toml channel and dtolnay/rust-toolchain@stable refs to 1.94.1 so a future rustc release no longer auto-rolls into CI/local builds. Bump deliberately when adopting new lints. Nightly refs (fuzz, nightly workflow, ci fuzz-check) remain on @nightly.
Marvin Attack on rsa (transitive via russh ssh-key) has no upstream patch (RustCrypto/RSA#19). The advisory is already ignored in CI's rustsec/audit-check step and is the same vuln Dependabot surfaces as moderate alert #27. Mirroring it in deny.toml lets `cargo deny check` succeed locally and documents the accepted risk in one place.
Without --all-features, cargo clippy on main emitted dead_code warnings for items only referenced from feature-gated callsites: * builtins/curl.rs: same_origin / SENSITIVE_HEADERS — used only inside the http_client redirect path * lib.rs: mod credential + pub use Credential — entire module is wired through #[cfg(feature = "http_client")] callers * lib.rs: BashBuilder::logic_only — only called from the scripted_tool module Add the matching #[cfg(...)] attributes so the warnings disappear in default-feature and single-feature builds, keeping local `cargo clippy` clean for contributors who don't pass --all-features.
Document that the rust-toolchain.toml channel and the dtolnay/rust-toolchain@<version> refs in CI are pinned together and bumped deliberately, so a future contributor doesn't revert to "stable" without realizing why.
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
bashkit | 15921e9 | Commit Preview URL Branch Preview URL |
May 02 2026, 04:40 PM |
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Punch-list cleanup from the Turso/SQLite review notes (items #9-11):
rustc 1.95release broke CI.rust-toolchain.tomlnow pins to1.94.1and everydtolnay/rust-toolchain@stableref across.github/workflows/*is pinned to@1.94.1. Bumps are now deliberate.@nightlyrefs (fuzz, nightly workflow, cifuzz-check) intentionally untouched.rsa, transitive viarusshssh-key). No upstream patch (modpow implementation is not constant-time RustCrypto/RSA#19). The advisory is already ignored byrustsec/audit-checkin CI; mirrored intodeny.tomlsocargo deny checksucceeds locally and the accepted risk is documented in one place. The Dependabot alert itself still needs a manual UI dismissal with reason "no patched version available".dead_codebaseline. Without--all-features,cargo clippyonmainemitted warnings for items only used from feature-gated callsites (builtins/curl.rs::same_origin,SENSITIVE_HEADERS; the entirecredentialmodule +pub use Credential;BashBuilder::logic_only). Added matching#[cfg(feature = "...")]attributes so default-feature and single-feature builds are warning-free for contributors who don't pass--all-features.rust-toolchain.tomland thedtolnay/rust-toolchain@<version>workflow refs are bumped together.Test plan
cargo fmt --all -- --checkcargo clippy --all-targets --all-features -- -D warningscargo clippy -p bashkit --all-targets(default features)cargo clippy -p bashkit --all-targets --no-default-featurescargo clippy -p bashkit --all-targets --features http_client(andssh,scripted_tool,sqliteindividually)cargo test --workspace --lib --bins --tests --features http_client,ssh,sqlite -- --skip ssh_supabase— 86 test groups, 0 failures (ssh_supabase_connectsskipped: needs live network to supabase.sh)rustupconfirms 1.94.1 is selected from the newrust-toolchain.tomlGenerated by Claude Code