Setup CI and update MSRV to 1.88 - #7
Open
dannywillems wants to merge 5 commits into
Open
Conversation
The crate declared a minimum supported Rust version of 1.60. Raise it to 1.88 so that it matches librustzcash, which already declares rust-version 1.88 with edition 2024. Crates that are compiled together should share a single minimum rather than force downstream users to satisfy a matrix of different floors. No source changes are required by the bump; the crate already builds, tests and lints cleanly on the newer toolchain. Co-Authored-By: Claude <noreply@anthropic.com>
The newer toolchain's clippy rejects the build under -D warnings with clippy::large_const_arrays on SINSEMILLA_S. The lint is correct here. SINSEMILLA_S is a table of 1024 pairs of pallas::Base, so 64 KiB. A const has no address of its own: it is inlined at each use site, so every crate that reads the table gets its own 64 KiB copy embedded in the binary, and an indexing expression can end up materialising the whole array before selecting one element. A static has a single address and is read in place, which is what indexing by a runtime chunk value in hash_to_point wants, and it matters more than usual here because the crate is no_std and may be linked into space-constrained targets. This is visible in the public API: SINSEMILLA_S can no longer be used in a const context by downstream code. Nothing in the tree relies on that, and the crate is still at 0.1.0, so the change is recorded in the changelog rather than worked around with an allow attribute. Co-Authored-By: Claude <noreply@anthropic.com>
Co-Authored-By: Claude <noreply@anthropic.com>
The repository had no CI at all, which is how a clippy failure and an
unenforced MSRV were able to sit in the tree unnoticed. Add workflows
modelled on the sibling crates, keeping only the jobs that apply here.
ci.yml runs on every push and pull request:
test the suite on Linux, Windows and macOS, with --all-features
and --no-default-features
test-32-bit the suite on i686-unknown-linux-gnu, so 32-bit hosts are
covered rather than assumed
no-std a build for thumbv6m-none-eabi, wasm32-unknown-unknown and
wasm32-wasip1; the crate is no_std with an alloc dependency
and all three were confirmed to build before the job was
written
msrv build and test on 1.88.0 with --locked, so the rust-version
declared in Cargo.toml is checked rather than asserted
doc-links cargo doc with RUSTDOCFLAGS=-D warnings, which promotes
broken intra-doc links to an error without the crate having
to carry a deny attribute
fmt cargo fmt --check
required an aggregate check, guarded by always() so that a skipped
job cannot pass as a satisfied required check
lints-stable.yml runs clippy with -D warnings on pull requests, and
lints-beta.yml runs it on the beta toolchain as an informative, non
blocking job so that a lint a future stable will enforce shows up early.
Jobs from the sibling repositories that were deliberately left out: a book
job, because there is no book; a benchmark bitrot job, because there are no
benchmarks; and code coverage, because it depends on an external service
and the crate has two tests, so the number would carry no information.
Every action is pinned to a full commit SHA with the version in a trailing
comment, checkout runs with persist-credentials disabled, permissions are
granted per job, and no context expression is interpolated into a run
script; matrix values are passed through the environment instead. The test
step sets shell: bash explicitly, because the Windows runner would
otherwise use PowerShell, where an environment reference written as
${FEATURES} expands to nothing and the features flag would be dropped.
Co-Authored-By: Claude <noreply@anthropic.com>
zizmor audits the workflows themselves for the failure modes that make CI a supply-chain surface: unpinned actions, over-broad permissions, a checkout that leaves credentials on disk, and shell injection through a context expression. Run it on pushes to main and on every pull request, matching the sibling repositories, and upload the SARIF so findings land in code scanning. The workflow needs no write access beyond security-events, so the file declares no permissions at the top level and the job grants itself only that one. Also give each workflow a concurrency group. A superseded run of the same workflow on the same pull request is cancelled, while pushes to a branch and to main are left alone so the history of results stays complete. This is what clears zizmor's concurrency-limits finding. zizmor 1.29.0 reports no findings on the default persona. On the pedantic persona two informational superfluous-actions notes remain, both saying that dtolnay/rust-toolchain could be replaced by calling rustup in a script step. They are left as they are, because the sibling repositories select toolchains through that action and the pinned action is easier to keep current than a hand-written rustup invocation. Co-Authored-By: Claude <noreply@anthropic.com>
dannywillems
commented
Sep 2, 2026
| - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # master | ||
| id: toolchain | ||
| with: | ||
| toolchain: "1.88.0" |
Author
There was a problem hiding this comment.
Should come from rust-toolchain.toml, but LGTM.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.