8d9a3ca9e9
All checks were successful
PR Check — Rust / rust (pull_request) Successful in 5m12s
Seven crates in Cargo.lock accept windows-sys through a wide bound (colored, dirs-sys, errno, rustix, rustls-platform-verifier, tempfile, winapi-util), so cargo may point them at any windows-sys version already in the graph. All seven point at 0.61.2, the state every Windows release has shipped with since v0.14.0. Some updates re-resolve them (cargo update -p hyper, -p h2, -p rustls-webpki -p tar did) down to 0.48/0.52/0.59 while cargo only reports the packages it bumped: the Windows build then compiles five windows-sys versions instead of three, and nothing says so. A new blocking step, "Verify windows-sys pinning", reads the lockfile with awk right after the suppression guard and fails if any edge of the seven crates leaves 0.61.2 (a bare edge only passes when the lockfile holds a single windows-sys, at 0.61.2), if a guarded crate has no block, or if the set of windows-sys versions changes. awk's exit code is tested apart from its output, every check is logged with a summary line, and a canary (tempfile) must be read and checked by the loop. The step text was extracted from the YAML and run as is, with the runner's bash options, on copies of the lockfile: main's and the five release tags' locks pass (9 checks, exit 0); the hyper-bumped lock, an added windows-sys 0.53.0, a renamed guarded crate, a missing lockfile and a guarded list without the canary all exit 1. ADR 0023 records why 0.61.2, the measured cost (3 versions compiled for Windows instead of 5), the triggers, the exit condition (windows-sys 0.62, or convergence on a single version) and the repair when the step fails. CLAUDE.md and docs/architecture.md cite the guard next to the suppression check. Cargo.lock and .cargo/audit.toml are untouched. Resolves #345 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| workflows | ||