From f1340c4d78348630c5e37ae262718d4f28b7830c Mon Sep 17 00:00:00 2001 From: Cryptskii Date: Wed, 9 Sep 2026 09:44:20 -0400 Subject: [PATCH] ci(deps): stop Dependabot proposing a toolchain bump it structurally cannot complete MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `dtolnay/rust-toolchain`'s tag IS the Rust version, and every `uses:` pin of it is a MIRROR of rust-toolchain.toml — which that file calls the sole normative declaration. `ci/check_toolchain_consistency.sh` exists to prove the two equal and runs in both `make lint` and the production safety checks. So a Dependabot bump of this action can never merge. It moves the mirrors and cannot move the normative file, so the consistency gate fails by design. PR #782 (1.98.0 -> 1.120.0) is the demonstration: Rust, Coverage, Embedded and Storage Node all red on a change that touched no code, and it has sat open since. Moving the toolchain is a deliberate, coordinated edit — rust-toolchain.toml first, then every mirror in ci.yml and release.yml, in one change, with the consistency gate green. Dependabot cannot author that, so it should not keep proposing half of it. Ignoring the action removes a permanently-red PR from the queue without weakening any pin: the pins stay exactly where they are, and the gate that proves them equal is untouched. #782 itself is left open for the owner to close; this only stops the next one. --- .github/dependabot.yml | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 5fabce702..c1351884d 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -55,3 +55,20 @@ updates: labels: - "ci" - "dependencies" + ignore: + # dtolnay/rust-toolchain's tag IS the Rust version, and every `uses:` pin + # of it is a MIRROR of rust-toolchain.toml — the sole normative + # declaration. ci/check_toolchain_consistency.sh exists to prove the two + # equal, and runs in `make lint` and ci/production_safety_checks.sh. + # + # So a Dependabot bump of this action can never merge: it moves the + # mirrors and cannot move the normative file, and the consistency gate + # fails by design. PR #782 (1.98.0 -> 1.120.0) is the demonstration — + # Rust, Coverage, Embedded and Storage Node all red, on a change that + # touched no code. + # + # Moving the toolchain is a deliberate, coordinated edit: rust-toolchain.toml + # first, then every mirror in ci.yml and release.yml, in one change, with + # the consistency gate green. Dependabot cannot author that, so it should + # not keep proposing half of it. + - dependency-name: "dtolnay/rust-toolchain"