chore(deps): consolidate Dependabot #336-#338 (wide, clap_complete, 2 actions) by doublegate · Pull Request #340 · doublegate/RustyNES

doublegate · 2026-08-03T19:10:08Z

Summary

Consolidates the three currently-open Dependabot PRs into a single change so they review, land, and close together. Matches this repo's standing "master Dependabot consolidation" practice.

Supersedes #336, #337, #338 — those will be closed in favour of this PR.

Bumps

Cargo (production-dependencies group, from #338) — Cargo.lock only, via cargo update -p <crate> --precise <ver>:

crate	from	to	role
`wide`	1.5.0	1.6.0	SIMD — the frontend software blitter
`clap_complete`	4.6.7	4.6.8	CLI shell-completion generation

GitHub Actions — floating @vN major tag → the exact patch Dependabot pins (its github-actions ecosystem then tracks them forward):

action	from	to	site
`taiki-e/install-action` (#337)	`@v2`	`@v2.85.5`	`security.yml` — cargo-audit + cargo-deny jobs (×2)
`gradle/actions/setup-gradle` (#336)	`@v6`	`@v6.2.0`	`android.yml` — foss+play bundle job

Verification

cargo update resolves clean; Cargo.lock carries wide 1.6.0 / clap_complete 4.6.8.
cargo check --workspace compiles the full graph on the new lockfile (frontend/mobile/android/ios/monetization included).
cargo build -p rustynes-core --target thumbv7em-none-eabihf --no-default-features — the standalone no_std build that a full workspace build masks (the lz4_flex-0.14 lesson) — stays green. wide is a frontend dep (not in the no_std chip-stack graph) and clap_complete is host-only, so neither can perturb it.
Both edited workflows parse as valid YAML.

No source or emulation-core changes — deterministic core byte-identical, so no CHANGELOG entry.

🤖 Generated with Claude Code

Summary by CodeRabbit

Chores
- Updated Android packaging workflow tooling for improved consistency.
- Pinned security audit actions to a specific version for more predictable workflow execution.

coderabbitai · 2026-08-03T19:10:28Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: fab72adf-4507-4395-92cf-a5a7db076cc7

📥 Commits

Reviewing files that changed from the base of the PR and between 0880ae6 and fb9bae3.

⛔ Files ignored due to path filters (1)

Cargo.lock is excluded by !**/*.lock, !Cargo.lock

📒 Files selected for processing (2)

.github/workflows/android.yml
.github/workflows/security.yml

📝 Walkthrough

Walkthrough

The Android packaging workflow now pins the Gradle setup action to v6.2.0. The security workflow pins both taiki-e/install-action usages to v2.85.5.

Changes

Workflow version pinning

Layer / File(s)	Summary
Android Gradle action pinning `.github/workflows/android.yml`	The Android packaging workflow uses `gradle/actions/setup-gradle@v6.2.0`.
Security action pinning `.github/workflows/security.yml`	The dependency-audit and cargo-deny jobs use `taiki-e/install-action@v2.85.5`.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related PRs

doublegate/RustyNES#316: Updates pinned GitHub Actions versions in repository workflows.
doublegate/RustyNES#336: Contains the same Gradle setup action update.
doublegate/RustyNES#337: Contains the same security action pinning changes.

Suggested labels: dependencies, github-actions

🚥 Pre-merge checks | ✅ 9

✅ Passed checks (9 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately identifies the consolidated dependency updates for wide, clap_complete, and two actions.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Docs-As-Spec Sync	✅ Passed	The commit changes only two workflow files and Cargo.lock; no rustynes-cpu/ppu/apu/mappers files change, and the updated crates are frontend dependencies.
Changelog Entry For User-Visible Changes	✅ Passed	The commit changes only Cargo.lock dependency versions and GitHub Actions pins; no source or user-facing behavior changes require a CHANGELOG entry, and [Unreleased] remains empty.
No Unwrap/Expect/Panic On Untrusted Input	✅ Passed	The PR changes only two workflow action pins and Cargo.lock package metadata; the added lines contain no unwrap(), expect(), or panic!() calls.
Safety Comment On New Unsafe Blocks	✅ Passed	The commit changes only two workflow files and Cargo.lock; no Rust files or added lines contain `unsafe` or `SAFETY`.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch chore/deps-consolidate-2026-08-03

_{Comment @coderabbitai help to get the list of available commands.}

Copilot

Pull request overview

Consolidates three Dependabot updates into one PR by updating the Rust lockfile for two crates and pinning two GitHub Actions to specific patch releases. This aligns with the repo’s “Dependabot consolidation” workflow while keeping changes limited to dependency metadata (no Rust source / emulation-core logic changes).

Changes:

Update Cargo.lock to wide 1.6.0 and clap_complete 4.6.8.
Pin taiki-e/install-action to v2.85.5 in the security workflows (audit/deny).
Pin gradle/actions/setup-gradle to v6.2.0 in the Android workflow.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated no comments.

File	Description
Cargo.lock	Updates lockfile entries for `wide` and `clap_complete` (and their resolved transitive deps).
.github/workflows/security.yml	Pins `taiki-e/install-action` to `v2.85.5` for `cargo-audit` and `cargo-deny` installation.
.github/workflows/android.yml	Pins `gradle/actions/setup-gradle` to `v6.2.0` for the Android CI job.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Roll the three currently-open Dependabot PRs into a single change so they land and close together instead of as three separate merges, matching this repo's standing "master Dependabot consolidation" practice. Cargo (production-dependencies group, #338): - wide 1.5.0 -> 1.6.0 (SIMD; used by the frontend software blitter) - clap_complete 4.6.7 -> 4.6.8 (CLI shell-completion generation) Cargo.lock is taken verbatim from Dependabot's #338 so the diff is exactly the four version+checksum lines and nothing else. A local `cargo update -p clap_complete --precise 4.6.8` additionally re-resolved four transitive `windows-sys` references off 0.61.2 (down to 0.52.0/0.48.0) -- a valid but non-minimal churn cargo does opportunistically against a newer registry index; Dependabot's own lockfile does NOT do this (clap 4.6.8 does not require it), and agy's review flagged the drift, so the minimal lockfile is used instead. `cargo metadata --locked` accepts it, so it is consistent with the manifest with zero re-resolution. GitHub Actions: - taiki-e/install-action v2 -> v2.85.5 (#337) -- both call sites in .github/workflows/security.yml (the cargo-audit and cargo-deny jobs, which install the prebuilt binaries rather than compiling them under the 1.96 pin). - gradle/actions/setup-gradle v6 -> v6.2.0 (#336) -- the Android foss+play bundle job in .github/workflows/android.yml. Both move from a floating `@vN` major tag to the exact patch Dependabot pins; Dependabot's github-actions ecosystem then tracks them forward. (agy suggested SHA-pinning; declined -- the repo deliberately keeps `@vN` tags for every action except the compiler-installing dtolnay/rust-toolchain, a documented maintenance-policy choice.) Verification: - Cargo.lock diff == Dependabot #338 (wide + clap_complete only, no windows-sys or other transitive churn); `cargo metadata --locked` clean. - `cargo check --workspace` compiles the full graph on the new lockfile. - `cargo build -p rustynes-core --target thumbv7em-none-eabihf --no-default-features` -- the standalone no_std build a full workspace build masks (the lz4_flex-0.14 lesson) -- stays green. - Both edited workflows parse as valid YAML. Supersedes #336, #337, #338 (closed in favour of this consolidated PR). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

github-actions · 2026-08-03T20:18:12Z

Antigravity review (Gemini via Ultra)

This PR updates GitHub Actions references to specific release tags and bumps clap_complete and wide dependencies in Cargo.lock.

Blocking issues

None found.

Suggestions

Pin GitHub Actions by full 40-character commit SHA rather than release tags (.github/workflows/android.yml:125, .github/workflows/security.yml:63,78) to prevent unexpected updates if tags are mutated upstream.

Nitpicks

Trivial dependency update consolidation; verify wide 1.5.0 to 1.6.0 minor version bump introduces no behavior changes across target platforms.

_{Automated first-pass review by agy on a self-hosted runner -- not a human review.}

Copilot AI review requested due to automatic review settings August 3, 2026 19:10

This was referenced Aug 3, 2026

chore(ci): bump gradle/actions from 6 to 6.2.0 #336

Closed

chore(ci): bump taiki-e/install-action from 2 to 2.85.5 #337

Closed

chore(deps)(deps): bump the production-dependencies group with 2 updates #338

Closed

Copilot started reviewing on behalf of doublegate August 3, 2026 19:10 View session

Copilot AI reviewed Aug 3, 2026

View reviewed changes

doublegate force-pushed the chore/deps-consolidate-2026-08-03 branch from 0880ae6 to fb9bae3 Compare August 3, 2026 20:17

doublegate merged commit a23223c into main Aug 3, 2026
28 checks passed

doublegate deleted the chore/deps-consolidate-2026-08-03 branch August 3, 2026 20:32

Navigation Menu

Uh oh!

chore(deps): consolidate Dependabot #336-#338 (wide, clap_complete, 2 actions) - #340

chore(deps): consolidate Dependabot #336-#338 (wide, clap_complete, 2 actions)#340
doublegate merged 1 commit into
mainfrom
chore/deps-consolidate-2026-08-03

doublegate commented Aug 3, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Aug 3, 2026 •

edited

Loading

Walkthrough

Changes

Uh oh!

Copilot AI left a comment

Uh oh!

github-actions Bot commented Aug 3, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

doublegate commented Aug 3, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Bumps

Verification

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Aug 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

github-actions Bot commented Aug 3, 2026

Antigravity review (Gemini via Ultra)

Blocking issues

Suggestions

Nitpicks

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

doublegate commented Aug 3, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Aug 3, 2026 •

edited

Loading