Skip to content

bump(cargo)!: 🚀 upgrades available#1363

Open
hedgehog-dataplane-update[bot] wants to merge 37 commits intopr/mvachhar/new-build-systemfrom
bump/cargo-upgrades
Open

bump(cargo)!: 🚀 upgrades available#1363
hedgehog-dataplane-update[bot] wants to merge 37 commits intopr/mvachhar/new-build-systemfrom
bump/cargo-upgrades

Conversation

@hedgehog-dataplane-update
Copy link
Contributor

🚀 Upgrades available

name      old req compatible latest new req
====      ======= ========== ====== =======
bnum      0.13.0  0.13.0     0.14.3 0.14.3 
kube      3.0.1   3.1.0      3.1.0  3.1.0  
kube-core 3.0.1   3.1.0      3.1.0  3.1.0  

⚠️ This Pull Request was automatically generated and should be carefully reviewed before acceptance. It may introduce breaking changes.

daniel-noland and others added 30 commits March 20, 2026 18:53
Bump aws-lc-rs 1.16.1 → 1.16.2 and aws-lc-sys 0.38.0 → 0.39.0 to
address RUSTSEC-2026-0048.

See https://rustsec.org/advisories/RUSTSEC-2026-0048

Co-Authored-By: Manish Vachharajani <manish@githedgehog.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Daniel Noland <daniel.noland@gmail.com>
Signed-off-by: Daniel Noland <daniel@githedgehog.com>
From the advisory:

ID: RUSTSEC-2026-0049
Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0049
If a certificate had more than one `distributionPoint`, then only the first `distributionPoint` would be considered
against each CRL's `IssuingDistributionPoint` `distributionPoint`, and then the certificate's subsequent
`distributionPoint`s would be ignored.

The impact was that correct provided CRLs would not be consulted to check revocation. With `UnknownStatusPolicy::Deny`
(the default) this would lead to incorrect but safe `Error::UnknownRevocationStatus`. With `UnknownStatusPolicy::Allow`
this would lead to inappropriate acceptance of revoked certificates.

This vulnerability is thought to be of limited impact. This is because both the certificate and CRL are signed -- an
attacker would need to compromise a trusted issuing authority to trigger this bug.  An attacker with such capabilities
could likely bypass revocation checking through other more impactful means (such as publishing a valid, empty CRL.)

More likely, this bug would be latent in normal use, and an attacker could leverage faulty revocation checking to
continue using a revoked credential.

This vulnerability is identified by
[GHSA-pwjx-qhcg-rvj4](GHSA-pwjx-qhcg-rvj4). Thank you to @1seal for
the report.

Signed-off-by: Daniel Noland <daniel@githedgehog.com>
Remove rust-toolchain.toml and the compile-env references from
.cargo/config.toml.  The Rust toolchain is now provided by the nix
shell via rust-overlay, so the toolchain file and the old compile-env
path/linker/target settings are no longer needed.

Replace them with nix-oriented environment variables: DATAPLANE_SYSROOT,
C_INCLUDE_PATH, LIBRARY_PATH, GW_CRD_PATH, LIBCLANG_PATH, and
PKG_CONFIG_PATH, all pointing into the nix-managed sysroot and devroot.

Co-Authored-By: Manish Vachharajani <manish@githedgehog.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Daniel Noland <daniel.noland@gmail.com>
Signed-off-by: Daniel Noland <daniel@githedgehog.com>
Add frr-agent, dplane-rpc, and dplane-plugin to gen-pins.sh and run it
to regenerate npins/sources.json.

Updated pins: crane v0.23.1, FRR stable/10.5, gateway v0.43.5,
nixpkgs-unstable, perftest, rust-overlay, Rust 1.94.0.
New pins: dplane-plugin, dplane-rpc, frr-agent.

Co-Authored-By: Manish Vachharajani <manish@githedgehog.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Daniel Noland <daniel.noland@gmail.com>
Signed-off-by: Daniel Noland <daniel@githedgehog.com>
Replace the elaborate .envrc (which sourced compile-env paths, computed
RUSTFLAGS per-profile, and set linker/CPU flags) with two lines: export
RUSTC_BOOTSTRAP=1 and prepend devroot/bin to PATH.  All build flags are
now managed by nix profiles.

Replace the FHS-based shell.nix (buildFHSEnv with hardcoded package list)
with a one-liner that imports default.nix and exposes its devenv attribute.

Co-Authored-By: Manish Vachharajani <manish@githedgehog.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Daniel Noland <daniel.noland@gmail.com>
Signed-off-by: Daniel Noland <daniel@githedgehog.com>
Reorganize nix/profiles.nix to consolidate build profile settings:

- Move --as-needed and --gc-sections from the performance-only link flags
  into common RUSTFLAGS so dead-code elimination applies to debug builds
  too (FRR builds are unaffected as they don't use RUSTFLAGS)
- Add fuzz profile (aliased to release for now)
- Enable Intel CET cf-protection hardening (-fcf-protection=full for
  CFLAGS, -Zcf-protection=full for RUSTFLAGS) in the x86_64 march block
  where it belongs, since cf-protection is an x86-only feature

Co-Authored-By: Manish Vachharajani <manish@githedgehog.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Daniel Noland <daniel.noland@gmail.com>
Signed-off-by: Daniel Noland <daniel@githedgehog.com>
Rework the llvm overlay to use the rust-overlay for toolchain management
instead of reading from rust-toolchain.toml.  This pins the LLVM toolchain
to the same version rustc was built against, ensuring ABI compatibility for
LTO and mixed C/Rust compilation.

Switch from llvmPackages to llvmPackages' (version-matched to rustc's LLVM),
add rustPlatform'-dev for dev tooling, use final instead of prev where
appropriate, and remove the redundant separateDebugInfo setting.

Also adds the rust-overlay to the overlay registry and removes unused
explicit parameters from the overlay entry point since individual overlays
destructure what they need from inputs.

Co-Authored-By: Manish Vachharajani <manish@githedgehog.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Daniel Noland <daniel.noland@gmail.com>
Signed-off-by: Daniel Noland <daniel@githedgehog.com>
Add a name attribute to the platform definition that maps bluefield2 to
"bluefield" for DPDK compatibility. DPDK internally uses the name "bluefield"
for the BF2 SoC definition, even though we generate a correct cross-compile
file with armv8.2-a / cortex-a72 (unlike DPDK's own soc meson.build which
only half-heartedly picks armv8-a).

BF2 is not a primary support target but serves as a useful cross-compilation
test target for the build tooling.

Co-Authored-By: Manish Vachharajani <manish@githedgehog.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Daniel Noland <daniel.noland@gmail.com>
Signed-off-by: Daniel Noland <daniel@githedgehog.com>
Remove the build-params default argument from the dpdk package in favor of
using platform.name directly and hardcoding buildtype/lto settings which are
always the same for our use case. Reorder and deduplicate meson flags, remove
the unused -Ddebug=false flag, and fix unnecessary nix string interpolation
in the cross-file argument.

Co-Authored-By: Manish Vachharajani <manish@githedgehog.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Daniel Noland <daniel.noland@gmail.com>
Signed-off-by: Daniel Noland <daniel@githedgehog.com>
Use version-matched LLVM packages (llvmPackages') consistently across both
overlays, following the llvm.nix rework.

dataplane-dev: Add optimized gdb' package with LTO, static linking, and
minimal features for container-friendly debugging.  This gives us a small
gdb binary suitable for inclusion in debugger container images without
pulling in the full desktop dependency tree.

dataplane: Pass platform and profile through to dpdk, remove unnecessary
output entries from libmd (man, dev), drop unused ethtool/iproute2 overrides
from rdma-core, fix llvmPackages->llvmPackages' for libunwind, fix
libX11->libx11 case in hwloc, and fix perftest callPackage argument passing.

Co-Authored-By: Manish Vachharajani <manish@githedgehog.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Daniel Noland <daniel.noland@gmail.com>
Signed-off-by: Daniel Noland <daniel@githedgehog.com>
Add a nix derivation for building FRR (Free Range Routing) from source with
only the routing daemons we need (bgpd, bfdd, staticd) and all others
disabled.  Packaging FRR in nix gives us reproducible builds with precise
control over dependencies and compile-time options.

The package includes:
- clippy-helper.nix: FRR's custom Clippy code generator, built as a native
  build tool and injected into the FRR build
- xrelifo.py.fix.patch: suppress false-positive build errors from FRR's
  xrelfo ELF annotation tool (error counting and -Werror interaction)
- yang-hack.patch: skip the lyd_find_xpath3 check in configure.ac to work
  with our pinned libyang version which provides equivalent functionality
  under a different symbol

Also registers the frr overlay in the overlay entry point
(nix/overlays/default.nix).

Co-Authored-By: Manish Vachharajani <manish@githedgehog.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Daniel Noland <daniel.noland@gmail.com>
Signed-off-by: Daniel Noland <daniel@githedgehog.com>
Package FRR runtime configuration as a separate derivation so it can be
composed independently into different container images (e.g. the dataplane
FRR container vs. the host FRR container).

Contents:
- daemons: FRR daemon selection and startup options
- vtysh.conf: VTY shell configuration
- zebra.conf: empty base config (populated at runtime)
- passwd/group: FRR service user and group definitions
- nsswitch.conf: name service configuration
- docker-start: container entrypoint script for FRR

Co-Authored-By: Manish Vachharajani <manish@githedgehog.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Daniel Noland <daniel.noland@gmail.com>
Signed-off-by: Daniel Noland <daniel@githedgehog.com>
Add nix derivation for the dataplane RPC library.  This is a C/C++ library
(built with CMake) that provides the gRPC interface used by the FRR
dplane-plugin to communicate route updates to the dataplane process.

Co-Authored-By: Manish Vachharajani <manish@githedgehog.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Daniel Noland <daniel.noland@gmail.com>
Signed-off-by: Daniel Noland <daniel@githedgehog.com>
Add nix derivation for the FRR dataplane plugin shared library.  This is a
CMake-built shared object loaded by FRR at runtime to forward route updates
to the dataplane process via dplane-rpc.

Co-Authored-By: Manish Vachharajani <manish@githedgehog.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Daniel Noland <daniel.noland@gmail.com>
Signed-off-by: Daniel Noland <daniel@githedgehog.com>
Add a nix derivation for frr-agent, the Hedgehog FRR management agent.
This is a Rust binary built with buildRustPackage from the pinned
frr-agent source.  References to build-time paths are stripped with
nuke-refs to keep the closure minimal.

Co-Authored-By: Manish Vachharajani <manish@githedgehog.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Daniel Noland <daniel.noland@gmail.com>
Signed-off-by: Daniel Noland <daniel@githedgehog.com>
Rework the core build machinery in default.nix to support the new nix-native
build pipeline.  The old default.nix was structured around the compile-env
sysroot approach; this rework introduces proper nix builders and integrates
FRR packaging support.

Changes:
- Add tag parameter for container/version tagging
- Add fuzz to cargo-profile map
- Add frr-pkgs import with FRR overlay
- Add comments explaining libc fully-qualified paths in sysroot
- Add skopeo to devroot for container operations
- Rework devenv from shellHook to structured env attributes
- Add jsonFilter for source filtering
- Simplify cargo-cmd-prefix (unconditional build-std-features)
- Remove sanitizer-conditional RUSTFLAGS block
- Add VERSION env var from tag parameter
- Rename package-builder to workspace-builder
- Rework test-builder to support building all tests at once
- Update crane config (removeReferencesToRustToolchain/VendorDir)
- Use clang++ as the linker driver instead of clang so that C++ standard
  library and exception handling runtime are linked correctly for
  transitive C++ dependencies (e.g. DPDK PMDs, hwloc)

Co-Authored-By: Manish Vachharajani <manish@githedgehog.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Daniel Noland <daniel.noland@gmail.com>
Signed-off-by: Daniel Noland <daniel@githedgehog.com>
Add docs-builder helper and docs output that runs `cargo doc` through the
nix build system with -D warnings.  Supports building docs for individual
packages or the entire workspace.

Co-Authored-By: Manish Vachharajani <manish@githedgehog.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Daniel Noland <daniel.noland@gmail.com>
Signed-off-by: Daniel Noland <daniel@githedgehog.com>
Rework the dataplane tar to use busybox (providing a shell and coreutils
in-container), symlinks instead of copies for binaries, and additional
security hardening:
- Add /home and /tmp directories
- Use symlinks to nix store paths instead of copying binaries
- Install busybox for minimal shell access
- Change tar permissions to ugo-sw (no write, no setuid/setgid)
- Add dontPatchShebangs, dontFixup, dontPatchElf
- Include workspace.dataplane, workspace.init, workspace.cli, busybox
  and glibc.libgcc unconditionally in the tar
- Rename attribute from dataplane-tar to dataplane.tar

Co-Authored-By: Manish Vachharajani <manish@githedgehog.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Daniel Noland <daniel.noland@gmail.com>
Signed-off-by: Daniel Noland <daniel@githedgehog.com>
Add container image definitions using nixpkgs dockerTools:
- containers.dataplane: production image with busybox, cli, init
- containers.dataplane-debugger: debug image with gdb, rr, libc debug symbols
- containers.frr.dataplane: FRR with dplane-plugin, dplane-rpc, frr-agent
- containers.frr.host: FRR host variant with fakeNss

The FRR containers include fakeRootCommands for /run/frr directory setup
and use tini as the entrypoint.

Co-Authored-By: Manish Vachharajani <manish@githedgehog.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Daniel Noland <daniel.noland@gmail.com>
Signed-off-by: Daniel Noland <daniel@githedgehog.com>
Add llvm tools to the dev shell for llvm-cov/llvm-profdata.  Set
CLANG_PATH, LLVM_COV, LLVM_PROFDATA, and CARGO_LLVM_COV_* env vars
in .cargo/config.toml.  Inject -ffile-prefix-map into all
dataplane-dep builds so coverage data maps /build paths back to
nix store source paths.

Co-Authored-By: Manish Vachharajani <manish@githedgehog.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Daniel Noland <daniel.noland@gmail.com>
Signed-off-by: Daniel Noland <daniel@githedgehog.com>
Rework build.rs scripts across the workspace to use the nix build
environment.  Remove the ureq-based CRD fetching and dotenvy env-file
parsing from k8s-intf build.rs; the CRD is now read from a nix-provided
path.  Remove build.rs from cli and sysfs (no longer needed).  Simplify
dpdk-sysroot-helper to read DATAPLANE_SYSROOT from the environment and
add rerun-if-env-changed directive.  Update Cargo.toml build-dependencies
to match.

Co-Authored-By: Manish Vachharajani <manish@githedgehog.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Daniel Noland <daniel.noland@gmail.com>
Signed-off-by: Daniel Noland <daniel@githedgehog.com>
Nix builds can't access the network from a build.rs script, so the prior
approach of fetching CRDs via ureq at build time won't work.

Move CRD binding generation from committed source to build.rs so that
bindings are always in sync with the CRD schema provided by nix.  This
eliminates the need to manually regenerate and commit the 500-line
gateway_agent_crd.rs file when the upstream CRD changes.

The generated module and its re-exports are removed; consumers now get
the bindings via the build-time generation in k8s-intf's build.rs (which
invokes kopium against the nix-provided CRD file).

Also simplify the version handling: get_gateway_version() now returns a
plain String (defaulting to "dev" when VERSION is unset) instead of
Option<String> that was always Some.  Remove the commented-out npins-based
version lookup and the now-unused serde_json build-dependency.

Remove the standalone rerun-if-changed for the sysroot path (now handled
by dpdk-sysroot-helper::use_sysroot()).

Co-Authored-By: Manish Vachharajani <manish@githedgehog.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Daniel Noland <daniel.noland@gmail.com>
Signed-off-by: Daniel Noland <daniel@githedgehog.com>
Add feature gates to the dataplane and init crates so DPDK and
dpdk-sysroot-helper are optional dependencies.  The dataplane crate gets
a `dpdk` feature (default on) with a corresponding cfg(feature = "dpdk")
gate on the DPDK driver module.  The init crate gets a `sysroot` feature
(default on).  This allows building without a DPDK sysroot for
development and testing scenarios.

Co-Authored-By: Manish Vachharajani <manish@githedgehog.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Daniel Noland <daniel.noland@gmail.com>
Signed-off-by: Daniel Noland <daniel@githedgehog.com>
Remove k8s-crd.env, rust.env, and test-runner.sh.  These scripts provided
environment variables and test execution support for the old compile-env
build approach.  Their functionality is now provided by:
- k8s-crd.env: nix build environment (GW_CRD_PATH in .cargo/config.toml)
- rust.env: nix shell and build profiles (nix/profiles.nix)
- test-runner.sh: n-vm test runner (#[n_vm::in_vm] annotations)

Co-Authored-By: Manish Vachharajani <manish@githedgehog.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Daniel Noland <daniel.noland@gmail.com>
Signed-off-by: Daniel Noland <daniel@githedgehog.com>
Replace the old fixin::wrap(with_caps(...)) capability-escalation pattern
on test_sample_config with #[n_vm::in_vm] and mark it #[ignore] pending
vm runner integration.  Add required dev-dependencies (n-vm,
tracing-subscriber to mgmt; tokio with full features to routing).
Deduplicate tokio feature flags in routing.

Co-Authored-By: Manish Vachharajani <manish@githedgehog.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Daniel Noland <daniel.noland@gmail.com>
Signed-off-by: Daniel Noland <daniel@githedgehog.com>
Rewrite the justfile to work with the nix build environment instead of the
old compile-env/docker approach.

Key changes:
- Remove all compile-env and docker container machinery (image pulling,
  docker socket handling, container-based builds)
- Remove dotenv loading of scripts/rust.env (environment now comes from nix)
- Replace target triple (x86_64-unknown-linux-gnu) with platform name
  (x86-64-v3/bluefield2) to match the nix platform abstraction
- Add nix-based build/push recipes that invoke nix build and skopeo
- Add sanitizer and instrumentation selection variables (sanitize, instrument)
- Simplify cargo invocations (no longer need explicit target/linker flags)
- Add FRR container image push alongside dataplane container
- Add `push` recipe for pushing all release container images
- Wrap test and lint recipes in nix-shell for toolchain access
- Rewrite coverage recipe to use nix-built test archives with local
  llvm-cov/llvm-profdata
- Rename clippy recipe to lint
- Remove obsolete recipes (hugepages, build-sweep, rustdoc-serve,
  setup/teardown-test-env)

Co-Authored-By: Manish Vachharajani <manish@githedgehog.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Daniel Noland <daniel.noland@gmail.com>
Signed-off-by: Daniel Noland <daniel@githedgehog.com>
Rewrite the dev.yml CI workflow to use nix instead of the compile-env/docker
build approach.

Key changes:
- Replace compile-env setup with cachix/install-nix-action and cachix for
  binary caching
- Replace the profile-only build matrix with a target x profile matrix:
  targets are nix outputs (tests.all, frr.dataplane, dataplane) and
  profiles include debug and release
- Comment out sanitizer matrix entries (address, thread) pending build-time
  and correctness fixes; when re-enabled they will use the fuzz profile
  with coverage instrumentation
- Wrap just/cargo invocations in nix-shell so the CI runner has access
  to the full nix-provided toolchain
- Use REGISTRY_URL (set by the reusable workflow) for container pushes
  instead of a hardcoded registry variable
- Rename the "check" job to "build" to better reflect what it does
- Add lint (clippy), rustdoc, and doctest steps for the tests.all matrix
  target so these checks are not lost in the workflow rewrite
- Override the devfiles change-detection gate for tag pushes and manual
  workflow dispatches so builds always run for releases
- Remove stale commented-out upgrade-from matrix entry
- Add FRR version bumping alongside dataplane in the tag-push release job
- Remove docker-based cargo/just invocations in favor of nix build commands

Co-Authored-By: Manish Vachharajani <manish@githedgehog.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Daniel Noland <daniel.noland@gmail.com>
Signed-off-by: Daniel Noland <daniel@githedgehog.com>
Rewrite README.md and test documentation to reflect the new nix-based
development workflow.

The old instructions required manually installing Rust via rustup, pulling
docker-based compile-env images, and symlinking /nix (the "fake nix" hack).
The new workflow is: install nix, enter the dev shell with `just shell`,
and use just recipes for building, testing, and linting.

Document build arguments (profile, sanitize, instrument, platform, jobs),
container build/push workflow, the lint and docs recipes, and
setup-roots for the initial sysroot/devroot symlink creation.

Also update the test-running docs to reference cargo-nextest and the
nix-shell environment instead of the old test-runner.sh script.

Co-Authored-By: Manish Vachharajani <manish@githedgehog.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Daniel Noland <daniel.noland@gmail.com>
Signed-off-by: Daniel Noland <daniel@githedgehog.com>
Add a 'features' argstr to default.nix (comma-separated, same pattern as
'sanitize') that injects --features into cargo-cmd-prefix.  This flows
through to all cargo invocations: workspace-builder, test-builder,
clippy-builder, and docs-builder.

Add a corresponding 'features' variable to the justfile that passes
through to nix build via --argstr.  The version string incorporates
enabled features (e.g. -feat.shuttle) for artifact disambiguation.

Add a 'filter' variable to the justfile that is forwarded to nextest
as a test name filter (e.g. 'shuttle' to run only shuttle-named tests).

Add shuttle test invocation to the CI test step: after the regular test
run, a second just invocation builds and runs the test archive with
features=shuttle and the 'shuttle' nextest filter, restoring the shuttle
concurrency testing that was present in the old workflow.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Daniel Noland <daniel@githedgehog.com>
daniel-noland and others added 7 commits March 20, 2026 21:01
…o justfile

Add private computed variables `_cargo_feature_flags` and `_cargo_profile_flag`
that each recipe can compose as needed (not all cargo subcommands accept all
flags).

- `_cargo_feature_flags`: expands --no-default-features and/or --features
  based on the `default_features` and `features` just variables.
- `_cargo_profile_flag`: expands --profile based on the `profile` variable
  (empty for debug since that is the cargo default).

Add `check-dependencies` recipe wrapping `cargo deny` with feature flags.
Add `doctest` recipe wrapping `cargo test --doc` with feature and profile flags.
Fix `lint` recipe to use the computed variables instead of hardcoding
`--all-features`.

Note: the lint fix portion is a fixup for:
  05065e0 build: rewrite justfile for nix build system
Adds the cargo-edit package (which provides `cargo upgrade`) to the nix
dev shell so that the bump workflow can run `cargo upgrade` within
nix-shell.
dev.yml:
- Route `cargo deny check` through `just check-dependencies` so feature
  flags are applied consistently via `_cargo_feature_flags`.
- Route `cargo test --doc` through `just doctest` so feature and profile
  flags are applied consistently.

bump.yml:
- Replace apt/binstall toolchain setup with nix-shell.
- Route `cargo deny` checks through `just check-dependencies` with
  explicit feature flag combinations.
- Run `cargo update` and `cargo upgrade` through nix-shell.
- Use `find` to glob Cargo.toml files in the upgrade commit step.
name old req compatible latest new req
==== ======= ========== ====== =======
bnum 0.13.0  0.13.0     0.14.3 0.14.3

Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
name old req compatible latest new req
==== ======= ========== ====== =======
kube 3.0.1   3.1.0      3.1.0  3.1.0

Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
name      old req compatible latest new req
====      ======= ========== ====== =======
kube-core 3.0.1   3.1.0      3.1.0  3.1.0

Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
@hedgehog-dataplane-update hedgehog-dataplane-update bot requested a review from a team as a code owner March 21, 2026 03:09
@hedgehog-dataplane-update hedgehog-dataplane-update bot added automated dependencies Pull requests that update a dependency file labels Mar 21, 2026
@hedgehog-dataplane-update hedgehog-dataplane-update bot requested review from mvachhar and removed request for a team March 21, 2026 03:09
@daniel-noland daniel-noland force-pushed the pr/mvachhar/new-build-system branch 12 times, most recently from 1023209 to 646dc68 Compare March 22, 2026 02:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

automated dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant