Skip to content

chore: update action dependencies and bump wash to v2.0.0-rc.7#16

Open
ericgregory wants to merge 7 commits intowasmCloud:mainfrom
ericgregory:main
Open

chore: update action dependencies and bump wash to v2.0.0-rc.7#16
ericgregory wants to merge 7 commits intowasmCloud:mainfrom
ericgregory:main

Conversation

@ericgregory
Copy link

@ericgregory ericgregory commented Feb 19, 2026 •
edited
Loading

Summary

  • Bump setup-wash-action submodule to latest (f27efbc), picking up the wash v2.0.0-rc.7 default and all fixes from chore: update wash default version to v2.0.0-rc.7 setup-wash-action#10
  • Update wash-version in CI from wash-v1.0.0-beta.8 to wash-v2.0.0-rc.7
  • SHA-pin and bump external action dependencies:
    • actions/checkout: v4 → v6.0.2 (SHA-pinned)
    • super-linter/super-linter/slim: v7.4.0 → v8.5.0 (SHA-pinned)
    • docker/login-action: v3.5.0 → v3.7.0 (SHA-pinned)
    • taiki-e/install-action: v2.62.6 → v2.68.3 (SHA-pinned)
    • actions/attest-build-provenance: floating @v3 → SHA-pinned v3.2.0
    • actions/attest-sbom: floating @v3 → SHA-pinned v3.0.0
  • Fix wash v2.0 project config format in setup-wash-cargo-auditable: wash v2.0 uses .wash/config.yaml (YAML) with a build.command string and build.component_path, replacing the old .wash/config.json (JSON) format with build.rust.custom_command array
  • Fix zizmor security findings surfaced by super-linter v8.5.0:
    • Moved all ${{ inputs.* }} references in run: blocks to env: blocks to prevent template injection (wash-build, wash-oci-publish)
    • Replaced all >> $GITHUB_ENV / >> $GITHUB_PATH writes with >> $GITHUB_OUTPUT using step IDs (wash-oci-publish)
  • Fix CI test project structure: cargo init creates a binary (command) crate, but wasmCloud components are reactor-style and require crate-type = ["cdylib"] to export WIT interfaces. Updated test to use cargo init --lib and append the correct [lib] section to Cargo.toml
  • Skip OCI publish test on fork PRs: the GITHUB_TOKEN for fork PRs is read-only regardless of workflow permissions, so pushing to GHCR is deferred to post-merge runs on main
  • Fix step ordering in CI test: Create test Rust project step now runs before Setup cargo-auditable (which reads Cargo.toml to derive the component path)

Test plan

  • CI passes on ericgregory/actions fork (ubuntu-latest)
  • wash build produces wasm component at expected path
  • .wash/config.yaml contains auditable build command
  • Lint passes with super-linter v8.5.0 / zizmor

ericgregory and others added 5 commits February 19, 2026 14:27
@ericgregory @claude
chore: update action dependencies and bump wash to v2.0.0-rc.7
d50375b 
- Bump setup-wash-action submodule to latest (f27efbc)
- Update wash-version in CI test to wash-v2.0.0-rc.7
- Bump actions/checkout from v4 to v6.0.2 (SHA-pinned)
- Bump super-linter from v7.4.0 to v8.5.0 (SHA-pinned)
- Bump docker/login-action from v3.5.0 to v3.7.0 (SHA-pinned)
- Bump taiki-e/install-action from v2.62.6 to v2.68.3 (SHA-pinned)
- Pin actions/attest-build-provenance to SHA for v3.2.0
- Pin actions/attest-sbom to SHA for v3.0.0

Signed-off-by: Eric Gregory <egregory04@gmail.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: Eric Gregory <egregory04@gmail.com>
@ericgregory
ci: trigger Actions run
a8e04c4 
Signed-off-by: Eric Gregory <egregory04@gmail.com>
@ericgregory @claude
fix: resolve wash v2.0 config format and zizmor security findings
5485b61 
CI failures:
- Update setup-wash-cargo-auditable to write .wash/config.yaml in wash
  v2.0 YAML format (build.command string, component_path derived from
  Cargo.toml package name) instead of the removed .wash/config.json schema
- Reorder test.yml steps so cargo init runs before setup-wash-cargo-auditable
  (Cargo.toml must exist for package name resolution)
- Update test.yml config verification to check .wash/config.yaml

Lint failures (zizmor findings from super-linter v8.5.0):
- wash-oci-publish: move all ${{ inputs.* }} used in run: blocks to env:
  blocks to prevent template injection
- wash-oci-publish: replace $GITHUB_ENV writes with $GITHUB_OUTPUT + step
  ids (image-info, extract-sbom, convert-sbom) to eliminate github-env
  findings
- wash-build: move ${{ steps.build.outputs.component_path }} to env: block
  in the verify step

Signed-off-by: Eric Gregory <egregory04@gmail.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: Eric Gregory <egregory04@gmail.com>
@ericgregory @claude
fix: replace Python heredoc with printf and remove GITHUB_PATH write
fe234f7 
- setup-wash-cargo-auditable: replace Python heredoc with printf to write
  .wash/config.yaml — the heredoc's unindented content broke YAML parsing
  of the action manifest
- wash-oci-publish: remove $GITHUB_PATH write by passing cyclonedx binary
  path via step output (install-cyclonedx) and referencing it via
  CYCLONEDX_BIN env var in convert-sbom step, eliminating last zizmor
  github-env finding

Signed-off-by: Eric Gregory <egregory04@gmail.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: Eric Gregory <egregory04@gmail.com>
@ericgregory @claude
fix: use cdylib library crate for wasm component test project
ed734e6 
cargo init creates a binary crate; wasm components require a cdylib
library crate to produce the expected .wasm artifact at
target/wasm32-wasip2/release/<name>.wasm

Signed-off-by: Eric Gregory <egregory04@gmail.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: Eric Gregory <egregory04@gmail.com>
@ericgregory
ci: skip OCI publish test on pull requests from forks
ba95748 
Fork PRs run with a read-only GITHUB_TOKEN regardless of workflow
permissions, so pushing to ghcr.io/wasmcloud/actions fails. Gate
the OCI publish test to push-to-main only where the token has full
package write access.

Signed-off-by: Eric Gregory <egregory04@gmail.com>
ricochet
ricochet approved these changes Feb 19, 2026
View reviewed changes
@ericgregory
ci: remove redundant wash config auditable check
39a2ac8 
The grep check on .wash/config.yaml only guards against regressions
in setup-wash-cargo-auditable's own source, which would be caught by
code review. It cannot be triggered by a consumer of the action.

Signed-off-by: Eric Gregory <egregory04@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ricochet ricochet ricochet approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@ericgregory @ricochet