Skip to content
This repository was archived by the owner on Oct 27, 2026. It is now read-only.

ci: pin upstream workflows and update TLS root stores - #9

Closed
samuelvanderwaal wants to merge 2 commits into
mainfrom
ci/pin-workflows-update-tls-roots
Closed

samuelvanderwaal wants to merge 2 commits into
mainfrom
ci/pin-workflows-update-tls-roots

Conversation

@samuelvanderwaal

@samuelvanderwaal samuelvanderwaal commented Oct 22, 2026 •

Copy link
Copy Markdown

Note: merge #10 first to get CI here passing.

Summary

  • Pin reusable workflows. main.yml, publish-js.yml and publish-rust.yml now reference solana-program/actions at commit 2db12a00 (upstream main as of 2026-10-02) instead of the main branch, so CI and publish runs execute a reviewed, fixed version.
  • Dependabot for Actions. New github-actions ecosystem entry so pin bumps arrive as reviewable PRs.
  • Publish guard. Both publish jobs only run on Sphere-Foundation/stake at refs/heads/main.
  • TLS root stores. Cargo.lock updates: webpki-roots 1.0.2 → 1.0.10, rustls-webpki 0.103.7 → 0.103.16, webpki-root-certs 0.26.8 → 0.26.11, picking up the October 2026 root store updates (RUSTSEC-2026-0381/0382/0383).

Test plan

  • make build-sbf-program
  • make test-program (357 tests)
  • make test-interface, make test-clients-rust
  • cargo +nightly-2025-02-16 check --workspace --all-targets --all-features
  • actionlint on the changed workflows

🤖 Generated with Claude Code

samuelvanderwaal and others added 2 commits October 22, 2026 10:09
Pin the three reusable workflows from solana-program/actions to commit
2db12a00 (upstream main at 2026-10-02) instead of the floating `main`
branch, and add a github-actions Dependabot entry so bumps arrive as
reviewable PRs.

Both publish jobs now only run on Sphere-Foundation/stake at
refs/heads/main.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
webpki-roots 1.0.2 -> 1.0.10, rustls-webpki 0.103.7 -> 0.103.16,
webpki-root-certs 0.26.8 -> 0.26.11, picking up the October 2026 root
store updates (RUSTSEC-2026-0381, -0382, -0383).

Verified: make build-sbf-program, make test-program, make test-interface,
make test-clients-rust, nightly check --workspace --all-features.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
@samuelvanderwaal

Copy link
Copy Markdown
Author

Closing: this repo is retired and will be archived. Changes for spherenet-stake will follow the program@v5.1.0 rebase.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant