pezkuwichain/pezkuwi-sdk
1
Fork 0
mirror of https://gitlab.com/pezkuwichain/pezkuwi-sdk.git synced 2026-10-20 18:56:23 +00:00
Code Releases Activity
367 Commits 2 Branches 0 Tags
287fbfbcd232f3b84e6d250d43721ac62a703bf1
Commit Graph
367 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
pezkuwichain 287fbfbcd2 docs: add DEVELOPMENT.md contributor setup guide 2026-04-21 20:27:35 +00:00
pezkuwichain 18d57b8e0c docs: add CODEOWNERS 2026-04-21 20:27:08 +00:00
pezkuwichain aa87740810 docs: add CHANGELOG.md 2026-04-21 20:26:51 +00:00
pezkuwichain b717fa5556 docs: add SECURITY.md — vulnerability disclosure policy 2026-04-21 20:26:11 +00:00
Kurdistan Tech Ministry 7caf11b2d2 ci: professional pipeline — unified image, nextest partitions, docs, schedules 2026-04-21 23:20:17 +03:00
Kurdistan Tech Ministry 4e6079fb47 ci: add GitLab CI pipeline with protobuf-compiler fix 2026-04-21 22:54:24 +03:00
pezkuwichain cc86ff5f2b security: remove AI tooling files — CLAUDE.md, .claude/ 2026-04-21 19:20:23 +02:00
pezkuwichain cb0ac10df2 security: ignore internal rebranding and operational scripts 2026-04-21 16:32:55 +00:00
pezkuwichain 6f61b89beb docs: remove local filesystem paths from runtimes-pallets.md 2026-04-21 16:31:49 +00:00
Kurdistan Tech Ministry 787efa3cce fix(security): update vulnerable dependencies, clean up deny.toml 
Cargo.lock updates (cargo update):
- tar 0.4.44 -> 0.4.45 (RUSTSEC-2026-0067, RUSTSEC-2026-0068)
- rustls-webpki 0.103.9 -> 0.103.11 (RUSTSEC-2026-0049)
- tracing-subscriber 0.3.22 -> 0.3.23
- yamux 0.13.8 -> 0.13.10 (RUSTSEC-2024-0428 for 0.13.x branch)

deny.toml: remove fixed advisory ignores, add accurate tracking comments

Remaining known issues (cannot fix without toolchain/vendor upgrade):
- wasmtime 37.x: fix in 42.x requires rustc 1.91 (pinned to 1.88)
- yamux 0.12.1: locked by libp2p-yamux 0.47.0 in zombienet vendor
 2026-04-14 00:15:21 +03:00
Kurdistan Tech Ministry a683b836fe chore: repo cleanup and security hardening 
- Remove stale root files: chain_spec.json, pezkuwi.gbp, publish.log,
  test-asset-hub.toml (moved to .claude/)
- Move publish_batch.sh and publish_crates.sh to scripts/
- Remove hardcoded /home/mamostehp/res/ paths from scripts and comments
  (WALLETS_FILE env var now required, no silent fallback)
- Update .gitignore: add protection entries for regenerable artifacts
  and .claude/ experience files
 2026-04-13 21:30:38 +03:00
Kurdistan Tech Ministry f82546fdb1 chore: add license files and attribution notice for Apache-2.0 compliance 
- Add LICENSE-APACHE (Apache License 2.0 full text)
- Add LICENSE-GPL3 (GNU GPL 3.0 full text)
- Add NOTICE file with full attribution to original Polkadot SDK,
  Parity Technologies (UK) Ltd., and Web3 Foundation, documenting
  all significant changes made as required by Apache-2.0 Section 4(b)
- Update README License section to accurately reflect dual licensing
  and link to NOTICE file
 2026-04-10 15:59:29 +03:00
Kurdistan Tech Ministry a0607b420c fix(security): add missing advisory ignores for cargo-audit + cargo-deny 
Re-add RUSTSEC-2023-0071 (rsa) and RUSTSEC-2025-0055 (tracing-subscriber)
which were incorrectly removed — they are still in transitive deps.

Add new advisories:
- RUSTSEC-2026-0067 (tar symlink traversal) — no 0.4.x patch available
- RUSTSEC-2026-0068 (tar link following) — no 0.4.x patch available
 2026-03-28 15:47:09 +03:00
Kurdistan Tech Ministry fd197ae78f fix: presale benchmark missing args + security audit advisory cleanup 
- Fix refund_cancelled_presale benchmark: add missing start_index and
  batch_size arguments (0, 100) to match the 3-param extrinsic signature
- Remove 3 stale RUSTSEC advisories from deny.toml and security-audit.yml
  (RUSTSEC-2023-0071, RUSTSEC-2025-0055, RUSTSEC-2026-0002 no longer in deps)
- Add RUSTSEC-2026-0049 (rustls-webpki) to ignore lists (upstream kube/jsonrpsee
  haven't released compatible versions yet)
 2026-03-27 09:34:47 +03:00
Kurdistan Tech Ministry 894617563a fix: default version=0.0.0 in generate-umbrella.py 2026-03-22 20:27:18 +03:00
Kurdistan Tech Ministry b27c12d306 fix(ci): add missing version field to umbrella Cargo.toml 2026-03-22 20:26:48 +03:00
Kurdistan Tech Ministry 9f4c9b4d19 style: fix formatting, regenerate umbrella, taplo format 2026-03-22 20:17:58 +03:00
Kurdistan Tech Ministry 288978c088 fix(security): audit fixes across 9 custom pallets 
- pez-rewards: checked arithmetic in parliamentary reward distribution
- tiki: saturating_add in get_tiki_score fold, benchmarking cleanup
- ping: saturating_add on PingCount
- staking-score: saturating_mul on 4 duration multipliers
- pez-treasury: proper error on TreasuryStartBlock None, saturating_add on NextReleaseMonth, doc fix 70->75%
- messaging: InboxOverflow event on FIFO eviction
- token-wrapper: reorder wrap/unwrap operations, add pallet balance pre-check
- welati: u64 cast for turnout percentage overflow prevention
- presale: fix refund calculation to use net_in_treasury (98%) instead of impossible 99%, update tests
 2026-03-22 18:56:37 +03:00
Kurdistan Tech Ministry ad9204cab1 fix(security): address HIGH audit findings across 5 pallets 
identity-kyc (H1):
- Add IdentityHashToAccount reverse mapping to prevent same identity hash
  being used by multiple accounts
- Check uniqueness in apply_for_citizenship, populate on confirm_citizenship,
  clean up on renounce_citizenship

pez-rewards (H2):
- Add EpochTotalClaimed storage to track claimed amounts per epoch
- do_close_epoch now only claws back unclaimed rewards (total_allocated -
  total_claimed), not the entire pot balance

tiki (H3):
- Replace custom "locked" attribute with pezpallet_nfts::disable_transfer()
  which sets the system-level PalletAttributes::TransferDisabled attribute
  that is actually enforced during transfers

tiki (H4):
- Fix EnsureTiki to check UserTikis storage for non-unique roles (Wezir,
  Parlementer) instead of TikiHolder which only stores unique roles

perwerde (H5):
- Add MaxPointsPerCourse config constant (1000 in runtime)
- Validate points in complete_course against the max
- Use saturating_add in get_perwerde_score to prevent u32 overflow

welati (H6):
- Add NativeCurrency: ReservableCurrency to Config
- Actually reserve candidacy deposit from candidate's balance

welati (H7):
- Add MaxEndorsers config constant (1000 in runtime)
- Validate endorsers count at the start of register_candidate before
  any storage reads
 2026-03-21 21:58:24 +03:00
Kurdistan Tech Ministry 741a65416a fix(security): address remaining CRITICAL audit findings 
presale:
- C2: Convert refund_cancelled_presale to batch pattern (start_index, batch_size)
  to prevent unbounded iteration with many contributors
- C3: Add status validation to cancel_presale — prevent cancelling Finalized/Failed
  presales (prevents double-dipping: tokens distributed + refund issued)
- C4: Enforce CreatePresaleOrigin (was defined in Config but never checked)
  Changed to Success = AccountId for proper owner extraction
- Clarified presale_account_id expect() safety comment (Blake2_256 = 32 bytes,
  always sufficient for AccountId decode)
- Removed unused imports (Defensive, AccountIdConversion)

perwerde:
- C5: Prevent NextCourseId overflow — added ensure!(< u32::MAX) check and
  replaced unchecked += 1 with saturating_add

welati:
- C6: Enforce access control on all CollectiveDecisionType variants:
  ConstitutionalReview/Unanimous → Diwan members only
  ExecutiveDecision → Serok only
  HybridDecision → Parliament OR Serok
  VetoOverride → Parliament members only
 2026-03-21 21:23:43 +03:00
Kurdistan Tech Ministry f1a7a7f872 fix(security): address critical audit findings in presale and validator-pool pallets 
presale:
- Split unbounded finalize_presale distribution into batched batch_distribute()
  extrinsic (same pattern as batch_refund_failed_presale) to prevent block weight
  exhaustion with many contributors
- Fix u128 overflow in calculate_reward_dynamic() by using
  multiply_by_rational_with_rounding() for safe intermediate multiplication
- Fix pre-existing batch_refund test assertion (platform fee deduction was not
  accounted for in expected refund amount)

validator-pool:
- Bound PoolMembers::iter() with .take(MaxPoolSize) in select_validators_for_era()
  to prevent unbounded iteration in on_initialize
- Fix on_initialize weight accounting to include all DB reads/writes from
  do_new_era() and select_validators_for_era() (was only counting 2 reads)
 2026-03-21 15:33:25 +03:00
Kurdistan Tech Ministry 420ed35169 feat: add weights, benchmarking, mock and tests for ping and teyrchain-info pallets 
- ping: weights.rs (WeightInfo trait + implementations), benchmarking.rs
  (v2-style benchmarks for start/start_many/stop/stop_all), mock.rs
  (test runtime with MockXcmSender), tests.rs (26 tests covering all extrinsics)
- teyrchain-info: mock.rs (minimal test runtime), tests.rs (7 tests for
  genesis config and ParaId getter)
- Updated ping lib.rs to use WeightInfo instead of zero weights
- Added WeightInfo = () to testing runtime Config
 2026-03-21 15:19:47 +03:00
Kurdistan Tech Ministry 66a4bfa86b fix(ci): trailing slash in debug Dockerfile COPY, make build-rustdoc non-blocking 2026-03-20 18:35:20 +03:00
Kurdistan Tech Ministry a525696e16 fix(docker): add trailing slash to COPY destination in malus Dockerfile 2026-03-19 18:46:53 +03:00
Kurdistan Tech Ministry 2ad475ceef ci: remove all zombienet CI infrastructure 
Zombienet tests are upstream Polkadot SDK tests with no custom pallet
coverage. Mainnet has 500K+ blocks, 9 successful upgrades, and zero
breakage — these tests provide no value for our project.

Removed 22 files (2293 lines):
- 6 workflow files (zombienet_*.yml, preflight, flaky-tests check)
- 3 custom actions (zombienet, zombienet-sdk, download-binaries)
- 5 scripts (dispatch, run, parse, process-logs, check-flaky)
- 5 config files (zombienet-env, flaky-tests, test definitions)
- 1 doc file (ZOMBIENET_CI.md)
- Remaining comment references in build-publish-images.yml
 2026-03-16 17:27:37 +03:00
Kurdistan Tech Ministry 86e44c151c ci: move zombienet tests to manual-only workflow_dispatch 
Zombienet tests are upstream Polkadot SDK tests without custom pallets.
They consume significant VPS resources (hours of build + test time) on
every push without providing project-specific value.

Removed from automatic CI:
- 4 zombienet artifact build jobs (prepare-*-zombienet-artifacts)
- bridges-zombienet-tests Docker image build
- 4 zombienet trigger jobs + confirmation gate

Zombienet workflows remain available for manual triggering:
  gh workflow run zombienet_pezkuwi.yml
  gh workflow run zombienet_pezcumulus.yml
  gh workflow run zombienet_bizinikiwi.yml
  gh workflow run zombienet_teyrchain-template.yml
 2026-03-16 17:18:17 +03:00
Kurdistan Tech Ministry 6c036bbe6f fix(ci): use upstream paritytech/zombienet Docker image 
Zombienet is a 3rd-party upstream tool — its Docker image should
reference paritytech/zombienet, not pezkuwi/zombienet which doesn't
exist on Docker Hub. This fixes all zombienet test failures caused
by image pull failures.
 2026-03-16 15:34:47 +03:00
Kurdistan Tech Ministry afa8bba099 fix(ci): change Docker Hub namespace from pezkuwichain/ to pezkuwi/ 
Docker Hub personal account namespace must match the username.
Updated all docker.io image references across workflows, actions,
docker-compose files, and zombienet configs.
 2026-03-14 15:58:50 +03:00
Kurdistan Tech Ministry 012807bf14 ci: trigger full workflow re-run with updated Docker Hub credentials 2026-03-13 15:17:14 +03:00
Kurdistan Tech Ministry 3bc4c8eda1 chore(deps): update quinn-proto to 0.11.14 (RUSTSEC-2026-0037 fix) 
Also updates windows-sys transitive dependency from 0.52 to 0.59.
 2026-03-12 04:24:51 +03:00
SatoshiQaziMuhammed f21c5ab99e chore(deps): bump the ci_dependencies group with 5 updates 
chore(deps): bump the ci_dependencies group with 5 updates
 2026-03-10 06:15:44 +03:00
dependabot[bot] 3bd2fa71eb chore(deps): bump the ci_dependencies group with 5 updates 
Bumps the ci_dependencies group with 5 updates:

| Package | From | To |
| --- | --- | --- |
| [benchmark-action/github-action-benchmark](https://github.com/benchmark-action/github-action-benchmark) | `1.20.7` | `1.21.0` |
| [docker/build-push-action](https://github.com/docker/build-push-action) | `6.19.2` | `7.0.0` |
| [docker/login-action](https://github.com/docker/login-action) | `3.7.0` | `4.0.0` |
| [actions/setup-node](https://github.com/actions/setup-node) | `6.2.0` | `6.3.0` |
| [tj-actions/changed-files](https://github.com/tj-actions/changed-files) | `47.0.4` | `47.0.5` |


Updates `benchmark-action/github-action-benchmark` from 1.20.7 to 1.21.0
- [Release notes](https://github.com/benchmark-action/github-action-benchmark/releases)
- [Changelog](https://github.com/benchmark-action/github-action-benchmark/blob/master/CHANGELOG.md)
- [Commits](https://github.com/benchmark-action/github-action-benchmark/compare/4bdcce38c94cec68da58d012ac24b7b1155efe8b...a7bc2366eda11037936ea57d811a43b3418d3073)

Updates `docker/build-push-action` from 6.19.2 to 7.0.0
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](https://github.com/docker/build-push-action/compare/10e90e3645eae34f1e60eeb005ba3a3d33f178e8...d08e5c354a6adb9ed34480a06d141179aa583294)

Updates `docker/login-action` from 3.7.0 to 4.0.0
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](https://github.com/docker/login-action/compare/c94ce9fb468520275223c153574b00df6fe4bcc9...b45d80f862d83dbcd57f89517bcf500b2ab88fb2)

Updates `actions/setup-node` from 6.2.0 to 6.3.0
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](https://github.com/actions/setup-node/compare/6044e13b5dc448c55e2357c09f80417699197238...53b83947a5a98c8d113130e565377fae1a50d02f)

Updates `tj-actions/changed-files` from 47.0.4 to 47.0.5
- [Release notes](https://github.com/tj-actions/changed-files/releases)
- [Changelog](https://github.com/tj-actions/changed-files/blob/main/HISTORY.md)
- [Commits](https://github.com/tj-actions/changed-files/compare/7dee1b0c1557f278e5c7dc244927139d78c0e22a...22103cc46bda19c2b464ffe86db46df6922fd323)

---
updated-dependencies:
- dependency-name: benchmark-action/github-action-benchmark
  dependency-version: 1.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ci_dependencies
- dependency-name: docker/build-push-action
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: ci_dependencies
- dependency-name: docker/login-action
  dependency-version: 4.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: ci_dependencies
- dependency-name: actions/setup-node
  dependency-version: 6.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ci_dependencies
- dependency-name: tj-actions/changed-files
  dependency-version: 47.0.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: ci_dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-09 03:24:09 +00:00
Kurdistan Tech MinistryandClaude Opus 4.6 d8550e2d76 style: fix rustfmt line length in BABE benchmarking blob 
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-07 01:22:57 +03:00
Kurdistan Tech MinistryandClaude Opus 4.6 d52551460c fix(ci): compress rustdoc artifact to prevent upload stall 
The VPS runner's limited bandwidth causes upload-artifact to stall when
uploading hundreds of MB of individual HTML files. Compress crate-docs
into a tar.gz before upload and extract on the publish side.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-07 01:07:07 +03:00
Kurdistan Tech Ministry 0dbe3a7032 fix(benchmarks): regenerate BABE equivocation proof blob, exclude revive benchmarks 
- Regenerate EQUIVOCATION_PROOF_BLOB in pezpallet-babe benchmarking:
  the old blob contained stale header hashes that caused
  check_equivocation_proof to fail with assertion error

- Exclude pezpallet_revive from quick-benchmarks via
  --exclude-pezpallets flag: revive benchmarks require PolkaVM
  toolchain (riscv64emac-unknown-none-polkavm) for fixture compilation
  which is not available in CI. This removes continue-on-error so
  real benchmark failures are now visible

- Increase build-rustdoc timeout from 180 to 240 minutes for VPS runner
 2026-03-06 16:52:47 +03:00
Kurdistan Tech Ministry 827128f5f7 chore: format deny.toml with taplo (alphabetical license order) 2026-03-05 03:41:02 +03:00
Kurdistan Tech Ministry 2fbe8da2cd fix(security): add NCSA and CDLA-Permissive-2.0 licenses, disable fail-fast 
- Add NCSA and CDLA-Permissive-2.0 to allowed licenses in deny.toml
  (both are permissive open-source licenses used by transitive deps)
- Set fail-fast: false on cargo-deny matrix so all checks run
  independently even if one fails
 2026-03-05 03:28:41 +03:00
Kurdistan Tech Ministry 6e307b0999 fix(security): set unmaintained=none in deny.toml 
All unmaintained crate warnings are transitive upstream dependencies
that we cannot replace. Disable unmaintained checks in cargo-deny
to prevent false CI failures. Track via quarterly review instead.
 2026-03-05 03:11:35 +03:00
Kurdistan Tech Ministry 4f672222f7 fix(security): upgrade deps and enforce security audit workflow 
- Upgrade bytes 1.11.0 → 1.11.1 (RUSTSEC-2026-0007 integer overflow)
- Upgrade time 0.3.46 → 0.3.47 (RUSTSEC-2026-0009 DoS stack exhaustion)
- Upgrade git2 0.20.3 → 0.20.4 (RUSTSEC-2026-0008 undefined behavior)
- Upgrade keccak 0.1.5 → 0.1.6 (RUSTSEC-2026-0012 unsoundness)
- Add ignore rules in deny.toml for unfixable upstream advisories
  (wasmtime 37.x, rsa, tracing-subscriber 0.2.x, lru)
- Remove continue-on-error from security-audit workflow — audit is now
  enforced and will block CI on new unignored vulnerabilities
 2026-03-05 03:00:59 +03:00
Kurdistan Tech Ministry bea99ee1b4 fix(messaging): fix clippy/rustdoc errors in benchmarking 
- Mark shell command doc block as ```text to fix rustdoc parsing
- Remove duplicated #![cfg(feature = "runtime-benchmarks")] (already gated in lib.rs)
- Use let _ = for unused MultiRemovalResults from clear_prefix
 2026-03-04 15:01:49 +03:00
Kurdistan Tech Ministry ea249f9f96 chore: gitignore operational scripts, add statement-distribution-legacy doc 
Ignore diagnostic/operational subxt examples that contain hardcoded VPS
addresses. Add missing implementers-guide documentation stub.
 2026-03-04 03:59:38 +03:00
Kurdistan Tech Ministry 0d3548a87b feat(people): add pezpallet-messaging to People Chain runtime 
End-to-end encrypted messaging pallet with citizenship and trust score
verification. Integrated into People Chain runtime as pallet index 55.
spec_version bumped to 1_020_009.
 2026-03-04 03:55:55 +03:00
Kurdistan Tech Ministry 93f1df24a1 feat(ci): switch CI image to GHCR mirror (package now public) 
GHCR package visibility set to public via org settings.
All container jobs can now pull from ghcr.io/pezkuwichain/ci-unified.
 2026-03-02 21:24:30 +03:00
Kurdistan Tech Ministry 4627d08954 fix(ci): revert to paritytech CI image until GHCR package is public 
GHCR packages are created as private by default and the visibility
cannot be changed via the REST API. Reverting to docker.io/paritytech
until the package visibility is changed to public via GitHub UI at:
https://github.com/orgs/pezkuwichain/packages/container/ci-unified/settings

The mirror-ci-image.yml workflow has already populated GHCR - just
need to make it public, then update this file to use GHCR.
 2026-03-02 15:16:39 +03:00
Kurdistan Tech Ministry c9be37fd95 feat(ci): switch CI image to GHCR mirror 
Now that the mirror-ci-image workflow has populated GHCR, switch
.github/env from docker.io/paritytech/ci-unified to our own
ghcr.io/pezkuwichain/ci-unified mirror.
 2026-03-02 15:11:07 +03:00
Kurdistan Tech Ministry d9c6dd3c60 refactor(ci): decouple from upstream Parity infrastructure 
Replace Parity-specific infrastructure dependencies with Pezkuwi's own:
- S3 release uploads → GitHub Releases (gh CLI)
- parity-zombienet runner labels → pezkuwi-runner
- Grafana/Loki log URLs → disabled (use GH artifacts)
- Matrix notifications → disabled (pending Pezkuwi Matrix)
- paritytech issue links → pezkuwi tracking issues
- paritytech Docker image refs → pezkuwi-sdk-frame in cmd.py
- Add mirror-ci-image.yml workflow for GHCR image mirroring
- Document upstream shared tools (resolc, try-runtime, evm-test-suite)
 2026-03-02 15:02:23 +03:00
Kurdistan Tech Ministry 83890ef729 fix(ci): update Docker action - fix master->main fallback tag, bump login-action to v3.7.0 
- Fix Docker image tag fallback from 'master' to 'main' to match our default branch
- Bump docker/login-action from v3.5.0 to v3.7.0 for consistency with other workflows
 2026-03-02 14:20:56 +03:00
SatoshiQaziMuhammed 8016844db7 Merge pull request #362 from pezkuwichain/dependabot/github_actions/ci_dependencies-5bf5cf5af6 
chore(deps): bump the ci_dependencies group across 1 directory with 14 updates
 2026-03-02 14:11:50 +03:00
dependabot[bot] b3d2a1837c chore(deps): bump the ci_dependencies group across 1 directory with 14 updates 
Bumps the ci_dependencies group with 14 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `5.0.0` | `6.0.2` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4.3.1` | `6.0.0` |
| [actions/download-artifact](https://github.com/actions/download-artifact) | `6.0.0` | `7.0.0` |
| [actions/create-github-app-token](https://github.com/actions/create-github-app-token) | `2.1.4` | `2.2.1` |
| [docker/build-push-action](https://github.com/docker/build-push-action) | `6.18.0` | `6.19.2` |
| [docker/login-action](https://github.com/docker/login-action) | `3.6.0` | `3.7.0` |
| [actions/setup-node](https://github.com/actions/setup-node) | `5.0.0` | `6.2.0` |
| [actions/cache](https://github.com/actions/cache) | `4.3.0` | `5.0.3` |
| [lycheeverse/lychee-action](https://github.com/lycheeverse/lychee-action) | `2.7.0` | `2.8.0` |
| [actions-rust-lang/setup-rust-toolchain](https://github.com/actions-rust-lang/setup-rust-toolchain) | `1.13.0` | `1.15.2` |
| [Swatinem/rust-cache](https://github.com/swatinem/rust-cache) | `2.7.8` | `2.8.2` |
| [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance) | `2.4.0` | `3.2.0` |
| [tj-actions/changed-files](https://github.com/tj-actions/changed-files) | `47.0.0` | `47.0.4` |
| [codecov/codecov-action](https://github.com/codecov/codecov-action) | `5.5.1` | `5.5.2` |



Updates `actions/checkout` from 5.0.0 to 6.0.2
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/08c6903cd8c0fde910a37f88322edcfb5dd907a8...de0fac2e4500dabe0009e67214ff5f5447ce83dd)

Updates `actions/upload-artifact` from 4.3.1 to 6.0.0
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/v4.3.1...b7c566a772e6b6bfb58ed0dc250532a479d7789f)

Updates `actions/download-artifact` from 6.0.0 to 7.0.0
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](https://github.com/actions/download-artifact/compare/018cc2cf5baa6db3ef3c5f8a56943fffe632ef53...37930b1c2abaa49bbe596cd826c3c89aef350131)

Updates `actions/create-github-app-token` from 2.1.4 to 2.2.1
- [Release notes](https://github.com/actions/create-github-app-token/releases)
- [Commits](https://github.com/actions/create-github-app-token/compare/67018539274d69449ef7c02e8e71183d1719ab42...29824e69f54612133e76f7eaac726eef6c875baf)

Updates `docker/build-push-action` from 6.18.0 to 6.19.2
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](https://github.com/docker/build-push-action/compare/263435318d21b8e681c14492fe198d362a7d2c83...10e90e3645eae34f1e60eeb005ba3a3d33f178e8)

Updates `docker/login-action` from 3.6.0 to 3.7.0
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](https://github.com/docker/login-action/compare/5e57cd118135c172c3672efd75eb46360885c0ef...c94ce9fb468520275223c153574b00df6fe4bcc9)

Updates `actions/setup-node` from 5.0.0 to 6.2.0
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](https://github.com/actions/setup-node/compare/v5...6044e13b5dc448c55e2357c09f80417699197238)

Updates `actions/cache` from 4.3.0 to 5.0.3
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](https://github.com/actions/cache/compare/0057852bfaa89a56745cba8c7296529d2fc39830...cdf6c1fa76f9f475f3d7449005a359c84ca0f306)

Updates `lycheeverse/lychee-action` from 2.7.0 to 2.8.0
- [Release notes](https://github.com/lycheeverse/lychee-action/releases)
- [Commits](https://github.com/lycheeverse/lychee-action/compare/a8c4c7cb88f0c7386610c35eb25108e448569cb0...8646ba30535128ac92d33dfc9133794bfdd9b411)

Updates `actions-rust-lang/setup-rust-toolchain` from 1.13.0 to 1.15.2
- [Release notes](https://github.com/actions-rust-lang/setup-rust-toolchain/releases)
- [Changelog](https://github.com/actions-rust-lang/setup-rust-toolchain/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions-rust-lang/setup-rust-toolchain/compare/v1.13...1780873c7b576612439a134613cc4cc74ce5538c)

Updates `Swatinem/rust-cache` from 2.7.8 to 2.8.2
- [Release notes](https://github.com/swatinem/rust-cache/releases)
- [Changelog](https://github.com/Swatinem/rust-cache/blob/master/CHANGELOG.md)
- [Commits](https://github.com/swatinem/rust-cache/compare/v2.7.8...779680da715d629ac1d338a641029a2f4372abb5)

Updates `actions/attest-build-provenance` from 2.4.0 to 3.2.0
- [Release notes](https://github.com/actions/attest-build-provenance/releases)
- [Changelog](https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md)
- [Commits](https://github.com/actions/attest-build-provenance/compare/v2.4.0...96278af6caaf10aea03fd8d33a09a777ca52d62f)

Updates `tj-actions/changed-files` from 47.0.0 to 47.0.4
- [Release notes](https://github.com/tj-actions/changed-files/releases)
- [Changelog](https://github.com/tj-actions/changed-files/blob/main/HISTORY.md)
- [Commits](https://github.com/tj-actions/changed-files/compare/24d32ffd492484c1d75e0c0b894501ddb9d30d62...7dee1b0c1557f278e5c7dc244927139d78c0e22a)

Updates `codecov/codecov-action` from 5.5.1 to 5.5.2
- [Release notes](https://github.com/codecov/codecov-action/releases)
- [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/codecov/codecov-action/compare/5a1091511ad55cbe89839c7260b706298ca349f7...671740ac38dd9b0130fbe1cec585b89eea48d3de)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 6.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: ci_dependencies
- dependency-name: actions/upload-artifact
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: ci_dependencies
- dependency-name: actions/download-artifact
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: ci_dependencies
- dependency-name: actions/create-github-app-token
  dependency-version: 2.2.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ci_dependencies
- dependency-name: docker/build-push-action
  dependency-version: 6.19.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ci_dependencies
- dependency-name: docker/login-action
  dependency-version: 3.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ci_dependencies
- dependency-name: actions/setup-node
  dependency-version: 6.2.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: ci_dependencies
- dependency-name: actions/cache
  dependency-version: 5.0.3
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: ci_dependencies
- dependency-name: lycheeverse/lychee-action
  dependency-version: 2.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ci_dependencies
- dependency-name: actions-rust-lang/setup-rust-toolchain
  dependency-version: 1.15.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ci_dependencies
- dependency-name: Swatinem/rust-cache
  dependency-version: 2.8.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ci_dependencies
- dependency-name: actions/attest-build-provenance
  dependency-version: 3.2.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: ci_dependencies
- dependency-name: tj-actions/changed-files
  dependency-version: 47.0.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: ci_dependencies
- dependency-name: codecov/codecov-action
  dependency-version: 5.5.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: ci_dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-02 11:07:51 +00:00
Kurdistan Tech Ministry f8c4bca688 fix(ci): fix Docker push permissions, macOS disk space, and audit summary overflow 
- build-publish-images: replace silent sudo chown failure (2>/dev/null || true)
  with proper error handling and fallback cleanup for all 7 push jobs.
  Root cause: container build jobs create root-owned files, non-container push
  jobs on runner2 couldn't sudo chown without sudoers config.
- tests-misc: add disk cleanup step to cargo-check-all-crate-macos job to free
  space before cargo check (remove Android SDK, old CLT SDKs, etc.)
- security-audit: truncate cargo-audit output to 500 lines before writing to
  GITHUB_STEP_SUMMARY to avoid the 1MB size limit crash.
 2026-03-02 13:58:38 +03:00