deps(actions)(deps): bump mozilla-actions/sccache-action from 0.0.10 to 0.0.11 - #114
Conversation
Bumps [mozilla-actions/sccache-action](https://github.com/mozilla-actions/sccache-action) from 0.0.10 to 0.0.11. - [Release notes](https://github.com/mozilla-actions/sccache-action/releases) - [Commits](Mozilla-Actions/sccache-action@v0.0.10...v0.0.11) --- updated-dependencies: - dependency-name: mozilla-actions/sccache-action dependency-version: 0.0.11 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
|
|
There was a problem hiding this comment.
Findings: no blocking issues. .github/workflows/rust-base.yaml:247, :376, and :716, plus .github/workflows/rust-build-binary.yaml:101, consistently move every sccache setup site to v0.0.11. The upstream action interface and Node 24 runtime are unchanged, the repository test and both Socket checks pass, and the missing Linear ticket is covered by the generated-dependency-update exemption. The only outstanding status is the pending license/cla check.\n\n@dependabot[bot]\n\nNext step: a maintainer should clear or waive the inapplicable CLA check and merge this dependency update.
phylax-ci
added
the
ticket-exempt
0xAlcibiades
left a comment
0xAlcibiades
left a comment
There was a problem hiding this comment.
Approve. Patch bump of a Mozilla-maintained action across the sccache setup sites, test green. Nit: same note as #112 — these uses: lines float on a tag while cargo-binstall in the same file is SHA-pinned; worth converting to SHA + version comment in a follow-up so the whole file follows one discipline.
phylax-ci
left a comment
phylax-ci
left a comment
There was a problem hiding this comment.
Follow-up review at 6affc87: no new inline findings and no blockers. This exact commit consistently updates all four sccache call sites; the upstream action interface and source logic are unchanged, and the repository test plus both Socket checks pass. The generated description covers the what/why and ticket exemption, though it does not include a verification command. The existing non-blocking SHA-pinning follow-up remains noted; license/cla is still pending but is not a code defect.
0xAlcibiades
left a comment
0xAlcibiades
left a comment
There was a problem hiding this comment.
Approving the bump — but flagging a supply-chain inconsistency on the exact lines this PR touches.
The bump itself: sccache-action 0.0.10 → 0.0.11, a compiler-cache wrapper with no effect on build correctness (a cache miss degrades to a slower build, never a wrong one). test is green. Fine to merge.
Finding: these references use a mutable tag while the rest of the repo SHA-pins
uses: mozilla-actions/sccache-action@v0.0.11Compare the neighbouring steps in this same file, and #113 landing beside it:
uses: cargo-bins/cargo-binstall@75b4bfae1b2c753a6806bbce6e6cb89b602de33c # v1.22.0v0.0.11 is a git tag, and a tag can be repointed at any commit by anyone who can push to that repo. An action running in these workflows executes arbitrary code on the runner with access to whatever that job holds — and this is phylaxsystems/actions, a reusable-workflow repo, so the blast radius is every repo in the org that calls rust-base.yaml, including the ones that pass private-dep credentials in adjacent steps.
The repo clearly already knows the practice; sccache-action is the exception, not the rule. Since dependabot is rewriting these exact lines anyway, this is the cheap moment to convert them:
uses: mozilla-actions/sccache-action@<sha-of-v0.0.11> # v0.0.11Dependabot maintains SHA pins with the trailing version comment perfectly well — that's how it's already handling cargo-binstall here — so this costs nothing ongoing. I'd treat it as a follow-up rather than a change to this PR, so the bump isn't held up.
Question: license/cla is PENDING on this PR and on #113. If that's a required check, dependabot PRs can never merge on their own — the classic never-reporting-required-check trap. Is it required, or informational? If required, it needs either a bot exemption or a no-op path for dependabot[bot] authors, otherwise this queue silently stops draining.
3 participants
Bumps mozilla-actions/sccache-action from 0.0.10 to 0.0.11.
Release notes
Sourced from mozilla-actions/sccache-action's releases.
Commits
fc920bfMerge pull request #262 from sylvestre/0.0.11c5764fdudpate dist filesce939d5update prettierfc24157prepare 0.0.11439ab27README.md prepare the version 0.0.11a2fac7aMerge pull request #252 from potiuk/ci-verify-dist4c2e5f0Merge pull request #253 from Mozilla-Actions/dependabot/npm_and_yarn/actions/...772f27dci: verify committed dist/ matches a clean rebuildd270be5Merge pull request #256 from Mozilla-Actions/dependabot/npm_and_yarn/jest-cir...52752aeMerge pull request #259 from Mozilla-Actions/dependabot/github_actions/github...Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)ticket-exempt: generated Dependabot dependency update; no dedicated engineering-capacity issue required.