mirror of
https://github.com/uutils/shadow.git
synced 2026-10-16 02:48:14 -07:00
Pierre Warnier
3a56b6107e
* ci: run the root test suite on pull requests, restrict token permissions About three quarters of the integration suite is root-only and returns silently when not root, reported as ok. The only job that runs as root was the Docker matrix, gated on push, so a pull request effectively tested a quarter of the suite and regressions surfaced only after merge. The matrix now runs on pull requests too; each distro takes a couple of minutes. The MSRV job checks --all-targets, so the test code is covered by the minimum supported version too, and both workflows declare least-privilege token permissions instead of inheriting the default scope. * ci: word-boundary the tooling-artifact patterns and cover two more forms The script's own comment claimed the patterns were word-boundaried; they were not, so several of them matched as substrings inside ordinary identifiers and English words, failing any change that happened to touch one. The alternation is now anchored with \b. Two forms that slipped through are added: a model name carrying a version suffix, and the co-author trailer a bot appends to a commit. CONTRIBUTING.md becomes exempt from the added-lines scan, because it states the project's policy on such tools and therefore has to be able to name them; the CI workflow no longer needs an exemption, since nothing in it matches. * deps: drop the unused clap derive feature, tighten the license policy Nothing in the tree derives clap's Parser/Args/Subcommand/ValueEnum, so the derive feature only pulled clap_derive and heck into the build graph. It is not the cause of the syn 2/3 duplicate: syn 3 arrives through uucore -> fluent -> displaydoc and syn 2 through landlock -> enumflags2, neither of which is ours to move. The deny skip now records that, and matches any 2.x rather than one stale patch version that no longer exists in the lockfile. MPL-2.0 leaves the license allowlist -- it is file-level copyleft and this project ships MIT only, so a dependency needing it should be a decision rather than a default -- and a crate from outside crates.io is now denied instead of warned about.