Pin module release builds to Rust 1.96.1 - #162
Conversation
|
Warning Review limit reached
This review includes 2 billable files and costs up to $0.50. Or wait 55 minutes for your next included review. View limit detailsLimit details: You’ve used the included review currently available. Review configuration: ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Advanced Run ID: 📒 Files selected for processing (2)
Comment |
Tiny Sweeper reviewTiny Sweeper reviewed this change across 6 lane(s) and found 3 active actionable finding(s). Detailed lane evidence and any incomplete work are listed below. State: Changes requested Review snapshot
Completeness: Complete What changedThe review could not produce a supported behavioral summary; inspect the cited changed surface and lane details below. FeaturesNone identified with supported citations. TestsNo supported feature-to-test mapping was produced. Test execution is not inferred. Findings
Resolved this pass
Before mergeNone. Agent review detailscritique
security
tests
commits
description
e2e
Evidence and run details
|
![tinysweeper[bot]](https://avatars.githubusercontent.com/in/4526585?s=60&v=4){kind=small}
There was a problem hiding this comment.
Requesting changes: 1 lane(s) blocking, worst finding is high.
Fix or reply to the findings below and push. The next review clears this automatically once they are gone — you should not need to dismiss anything by hand.
$0.0024 · 82,257 in / 6,876 out · 4,912 cached (6%) · ladder/vectors, gpt-5.6-luna, deepseek-v4-flash · 51 embedded
critique: $0.0012 · 40,403 in / 2,997 out · 2,066 cached (5%) · gpt-5.6-luna, deepseek-v4-flash
security: $0.0010 · 36,922 in / 1,033 out · 1,822 cached (5%) · gpt-5.6-luna
description: $0.0001 · 3,456 in / 1,720 out · 1,024 cached (30%) · deepseek-v4-flash
| @@ -0,0 +1,3 @@ | |||
| [toolchain] | |||
| channel = "1.96.1" | |||
| profile = "minimal" | |||
There was a problem hiding this comment.
Install the components required by repository checks
A minimal rustup profile does not install rustfmt or clippy, so developers using this rust-toolchain.toml will fail the documented cargo fmt and cargo clippy commands with missing-component errors. Add both components to the toolchain configuration.
[RULE] missing-toolchain-components ·
|
|
||
| - name: Build with the declared MSRV | ||
| run: cargo build --all-targets --all-features | ||
| run: cargo +${{ steps.msrv.outputs.version }} build --all-targets --all-features |
There was a problem hiding this comment.
Pass the MSRV through a quoted environment variable
steps.msrv.outputs.version is derived from Cargo.toml in the checked-out repository and is interpolated directly into a shell command. A crafted value that reaches this output could alter the command executed by the runner. Put the output in an environment variable and invoke Cargo with the quoted variable, for example cargo +"$MSRV" build ....
Additional critique observation
Pass the MSRV through the environment before invoking the shell
[RULE] shell-interpolation
steps.msrv.outputs.version is derived from the repository's Cargo.toml, which is untrusted in pull-request CI, and is interpolated directly into run. Keep the expression in an env value and invoke cargo +"$MSRV" ... so repository-controlled data is not expanded as shell source.
[RULE] untrusted-shell-interpolation ·
tinysweeper
Bot
added
the
priority: p1
There was a problem hiding this comment.
Requesting changes: 2 lane(s) blocking, worst finding is medium.
Fix or reply to the findings below and push. The next review clears this automatically once they are gone — you should not need to dismiss anything by hand.
$0.0033 · 97,531 in / 12,734 out · 17,835 cached (18%) · ladder/vectors, gpt-5.6-luna, deepseek-v4-flash · 51 embedded
critique: $0.0012 · 41,298 in / 2,919 out · 7,733 cached (19%) · gpt-5.6-luna, deepseek-v4-flash
security: $0.0015 · 50,739 in / 3,248 out · 7,286 cached (14%) · gpt-5.6-luna
description: $0.0003 · 3,763 in / 3,220 out · 2,304 cached (61%) · deepseek-v4-flash
|
|
||
| - name: Build with the declared MSRV | ||
| run: cargo build --all-targets --all-features | ||
| run: cargo +${{ steps.msrv.outputs.version }} build --all-targets --all-features |
There was a problem hiding this comment.
Pass the MSRV through the environment before invoking the shell
The MSRV output is currently expanded into the run script itself. Environment passing keeps the value as data and prevents shell parsing of repository-controlled content; define an MSRV step environment variable from the output and use "+$MSRV" in the command.
[RULE] shell-injection ·
| @@ -0,0 +1,3 @@ | |||
| [toolchain] | |||
| channel = "1.96.1" | |||
| profile = "minimal" | |||
There was a problem hiding this comment.
Install the components required by repository checks
The minimal rustup profile does not install rustfmt, clippy, or llvm-tools-preview, while the repository's CI checks require these components. Add them explicitly so a fresh checkout using this toolchain file can run the documented checks.
[RULE] missing-toolchain-components ·
1 participant
Pins the release compiler to the OpenHuman host toolchain (Rust 1.96.1). Cargo commands in CI and release workflows now select this version through rust-toolchain.toml. Part of tinyhumansai/openhuman#6614 and #6420. A new module release and an OpenHuman registry pin are still needed to replace already-published artifacts.