docs

fix(deps): update dependency com.fasterxml.jackson.core:jackson-databind to v2.18.9 [security] #546

Workflow file for this run

	name: docs

	# `README.md` is generated from `.github/templates/README.md.hbs`. This workflow is what makes
	# that claim true in both directions.
	#
	# On a pull request it renders the template and commits the result to the branch, so nothing the
	# README quotes about itself is edited by hand: the tag its install snippets pin, the MSRV its
	# badge shows, the licence its last section names, and the table of everything under `docs/`.
	# The case that matters is the release-please pull request: that
	# commit is the one which changes `version` in `Cargo.toml`, so it is also the one where the
	# README would otherwise start advertising the previous tag. Rendering here means the released
	# README already points at the tag the merge is about to create.
	#
	# Everywhere it cannot commit — a push to `main`, a pull request from a fork — it renders in
	# `check` mode instead, writing nothing and failing if the committed `README.md` is stale.
	# Without it, editing `README.md` directly would appear to work right up until the next pull
	# request silently reverted it.

	on:
	pull_request:
	push:
	branches: [main]

	# Shared with update-files.yaml, not scoped to this workflow: both commit to the pull request
	# branch, and the API call that makes a verified commit rejects one whose parent has moved. Two
	# renders of the same branch racing would leave one of them failing for no reason a reader could
	# act on, so they queue instead. `cancel-in-progress: false` for the same reason — a cancelled
	# run here means a branch left holding a half-generated file.
	concurrency:
	group: branch-writes-${{ github.ref }}
	cancel-in-progress: false

	permissions: {}

	jobs:
	render:
	name: render
	# Forks get no secrets, so the App token would be empty and the commit could not be pushed
	# to their branch anyway. `check` below picks those pull requests up instead.
	if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository
	runs-on: ubuntu-latest
	timeout-minutes: 10
	permissions:
	contents: read # the write happens with the App token below, not with GITHUB_TOKEN
	steps:
	- name: Harden Runner
	uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
	with:
	egress-policy: audit

	# An App installation token, so the commit is verified and — unlike one made with
	# `GITHUB_TOKEN` — re-triggers the checks on the branch it lands on.
	- name: Generate Bot Token
	id: generate_token
	uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
	with:
	app-id: ${{ secrets.ACTIONS_MAINTENANCE_APP_ID }}
	private-key: ${{ secrets.ACTIONS_MAINTENANCE_PRIVATE_KEY }}
	permission-contents: write

	# The head of the branch, not the merge commit: the render has to read the `Cargo.toml`
	# the pull request proposes, and the commit has to land on top of what is there now.
	- name: Checkout
	uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
	with:
	ref: ${{ github.head_ref }}
	persist-credentials: false

	# Invoked through `bash` rather than executed: the repository is authored on Windows, where
	# git does not record the executable bit.
	- name: Generate the configuration payload
	id: config
	run: \|
	set -euo pipefail
	json="$(bash .github/scripts/readme-variables.sh)"
	echo "json=${json}" >> "$GITHUB_OUTPUT"

	# `branch` is the default branch rather than the action's `github.ref_name` default, which
	# on a pull_request event is `<number>/merge`. Left alone, the badge URL rendered here and
	# the one rendered by `check` on `main` differ, and the gate fails on every merge for a
	# reason absent from the diff.
	- name: Collect the README payload
	id: variables
	uses: TimSchoenle/actions/actions/common/readme-variables@cf936b448984595778c82c079af93d0bb5d49297 # tag=actions-common-readme-variables-v1.2.1
	with:
	branch: ${{ github.event.repository.default_branch }}
	manifest: rust/Cargo.toml
	docs-dir: rust/docs
	extra: ${{ steps.config.outputs.json }}

	- name: Render and commit the README
	id: readme
	uses: TimSchoenle/actions/actions/common/render-template-and-commit@8097180ae2cd49922941c28c53e17c636ba5b8f2 # tag=actions-common-render-template-and-commit-v1.1.8
	with:
	template: .github/templates/README.md.hbs
	output: rust/README.md
	variables: ${{ steps.variables.outputs.variables }}
	token: ${{ steps.generate_token.outputs.token }}
	commit_message: "docs: render README from template"

	# The repository's front door, rendered from the same payload. It quotes none of the
	# crate-specific fields (MSRV, the docs table), so the manifest/docs-directory inputs above
	# only matter to the crate render — this one only reads `repo`.
	- name: Render and commit the root README
	id: root_readme
	uses: TimSchoenle/actions/actions/common/render-template-and-commit@30bc73a560c7aac65f449b23378b9fd7782f8d39 # tag=actions-common-render-template-and-commit-v1.1.6
	with:
	template: .github/templates/root-README.md.hbs
	output: README.md
	variables: ${{ steps.variables.outputs.variables }}
	token: ${{ steps.generate_token.outputs.token }}
	commit_message: "docs: render root README from template"

	- name: Summarise
	env:
	COMMITTED: ${{ steps.readme.outputs.changes_detected }}
	COMMIT_URL: ${{ steps.readme.outputs.commit_url }}
	ROOT_COMMITTED: ${{ steps.root_readme.outputs.changes_detected }}
	ROOT_COMMIT_URL: ${{ steps.root_readme.outputs.commit_url }}
	run: \|
	if [ "${COMMITTED}" = "true" ]; then
	echo "rust/README.md re-rendered: ${COMMIT_URL}" >> "$GITHUB_STEP_SUMMARY"
	else
	echo "rust/README.md already matched its template." >> "$GITHUB_STEP_SUMMARY"
	fi
	if [ "${ROOT_COMMITTED}" = "true" ]; then
	echo "README.md re-rendered: ${ROOT_COMMIT_URL}" >> "$GITHUB_STEP_SUMMARY"
	else
	echo "README.md already matched its template." >> "$GITHUB_STEP_SUMMARY"
	fi

	check:
	name: readme
	# The complement of `render`: it covers the pushes to `main` that no pull request rendered,
	# and the fork pull requests that could not be committed to. Between the two conditions every
	# event this workflow sees is handled by exactly one job.
	if: github.event_name == 'push' \|\| github.event.pull_request.head.repo.full_name != github.repository
	runs-on: ubuntu-latest
	timeout-minutes: 10
	permissions:
	contents: read
	steps:
	- name: Harden Runner
	uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
	with:
	egress-policy: audit

	- name: Checkout
	uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
	with:
	persist-credentials: false

	- name: Generate the configuration payload
	id: config
	run: \|
	set -euo pipefail
	json="$(bash .github/scripts/readme-variables.sh)"
	echo "json=${json}" >> "$GITHUB_OUTPUT"

	- name: Collect the README payload
	id: variables
	uses: TimSchoenle/actions/actions/common/readme-variables@cf936b448984595778c82c079af93d0bb5d49297 # tag=actions-common-readme-variables-v1.2.1
	with:
	branch: ${{ github.event.repository.default_branch }}
	manifest: rust/Cargo.toml
	docs-dir: rust/docs
	extra: ${{ steps.config.outputs.json }}

	# Writes nothing; fails with the first differing line when README.md is stale.
	- name: Verify rust/README.md is current
	uses: TimSchoenle/actions/actions/common/render-template@cf936b448984595778c82c079af93d0bb5d49297 # tag=actions-common-render-template-v1.2.1
	with:
	template: .github/templates/README.md.hbs
	output: rust/README.md
	variables: ${{ steps.variables.outputs.variables }}
	check: true

	- name: Verify README.md is current
	uses: TimSchoenle/actions/actions/common/render-template@30bc73a560c7aac65f449b23378b9fd7782f8d39 # tag=actions-common-render-template-v1.2.0
	with:
	template: .github/templates/root-README.md.hbs
	output: README.md
	variables: ${{ steps.variables.outputs.variables }}
	check: true

Navigation Menu

fix(deps): update dependency com.fasterxml.jackson.core:jackson-databind to v2.18.9 [security] #546

Workflow file

fix(deps): update dependency com.fasterxml.jackson.core:jackson-databind to v2.18.9 [security] #546

Uh oh!

Workflow file for this run