ci(deps): stop Dependabot proposing a toolchain bump it structurally cannot complete - #805
Merged
Merged
Conversation
…cannot complete `dtolnay/rust-toolchain`'s tag IS the Rust version, and every `uses:` pin of it is a MIRROR of rust-toolchain.toml — which that file calls the sole normative declaration. `ci/check_toolchain_consistency.sh` exists to prove the two equal and runs in both `make lint` and the production safety checks. So a Dependabot bump of this action can never merge. It moves the mirrors and cannot move the normative file, so the consistency gate fails by design. PR #782 (1.98.0 -> 1.120.0) is the demonstration: Rust, Coverage, Embedded and Storage Node all red on a change that touched no code, and it has sat open since. Moving the toolchain is a deliberate, coordinated edit — rust-toolchain.toml first, then every mirror in ci.yml and release.yml, in one change, with the consistency gate green. Dependabot cannot author that, so it should not keep proposing half of it. Ignoring the action removes a permanently-red PR from the queue without weakening any pin: the pins stay exactly where they are, and the gate that proves them equal is untouched. #782 itself is left open for the owner to close; this only stops the next one.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Noticed while surveying the open-PR queue: #782 can never merge, and neither can any successor to it.
dtolnay/rust-toolchain's tag is the Rust version, and everyuses:pin of it — nine acrossci.ymlandrelease.yml— is a mirror ofrust-toolchain.toml, which that file itself calls "the SOLE NORMATIVE declaration".ci/check_toolchain_consistency.shexists specifically to prove the two equal, and runs in bothmake lintandci/production_safety_checks.sh.A Dependabot bump of the action moves the mirrors and cannot move the normative file, so the consistency gate fails by design. #782 (1.98.0 → 1.120.0) is the demonstration: Rust, Coverage, Embedded and Storage Node all red on a change that touched no code, and it has sat open since.
What this changes
One
ignoreentry fordtolnay/rust-toolchainin thegithub-actionsecosystem, with the reasoning inline so the next reader does not have to re-derive it.No pin moves and no gate weakens. The nine
uses:pins stay exactly where they are,rust-toolchain.tomlis untouched, and the consistency script is untouched. The only change is that Dependabot stops opening a PR that is structurally unmergeable.Moving the toolchain remains a deliberate, coordinated edit:
rust-toolchain.tomlfirst, then every mirror, in one change, with the consistency gate green. Dependabot cannot author that, which is exactly why it should not keep proposing half of it.Not done here
#782 is left open for you to close. Closing someone's PR is your call, not mine; this only stops the next one from being opened.
YAML shape verified by hand against the two existing
ignoreblocks: three ecosystems,ignore:at indent 4 in all three,- dependency-name:at indent 6 in all five entries.