Merge branch 'main' into fix-log-level-filtering

.github/workflows/build-runner.yaml

@@ -39,7 +39,7 @@ jobs:
         shell: bash
 
       - name: Build and push Docker image
-        uses: docker/build-push-action@4f58ea79222b3b9dc2c8bbdd6debcef730109a75
+        uses: docker/build-push-action@48aba3b46d1b1fec4febb7c5d0c644b249a11355
         with:
           context: ./docker
           file: ./docker/runner.Dockerfile

.github/workflows/build/action.yaml

@@ -14,21 +14,18 @@ runs:
       if: ${{ contains(fromJSON('["pull_request"]'), github.event_name) }}
       id: cargo-deny
       run: |
-        set -xe
-        command -v cargo-deny >/dev/null 2>&1 || {
-          echo Installing cargo-deny >&2
-          cargo install --quiet cargo-deny
-        }
-        bin/cargo-deny-checks.sh
+        set -euxo pipefail
+        rye sync
+        rye run python3 scripts/cargo-deny-checks.py
       shell: bash
 
     - name: "Build and repin"
       id: build
       run: |
-        set -x
+        set -euxo pipefail
         rm -rf /home/runner/work/_temp/*/cache.tzst
         function bazel_build_auto_repin() {
-            local MYTMPDIR="$(mktemp -d)"
+            MYTMPDIR="$(mktemp -d)"
             trap 'rm -rf -- "$MYTMPDIR"' EXIT
             local logfile="$MYTMPDIR/bazel-out.log"
             local r=0
@@ -55,6 +52,7 @@ runs:
     - name: Commit files
       if: ${{ steps.build.outputs.repin == 'true' }}
       run: |
+        set -euxo pipefail
         CARGO_BAZEL_REPIN=true bazel build ... || return $?
         git config --local user.email "github-actions[bot]@users.noreply.github.com"
         git config --local user.name "github-actions[bot]"
@@ -65,6 +63,7 @@ runs:
       if: ${{ steps.build.outputs.repin == 'true' }}
       uses: ad-m/github-push-action@master
       with:
+        github_token: ${{ inputs.GITHUB_TOKEN }}
         branch: ${{ github.head_ref }}
 
     # TODO: right now we can't do it because our runners run in "kubernetes mode"
@@ -74,9 +73,7 @@ runs:
       if: ${{ !startsWith(runner.name, 'dre-runner-custom') }}
       shell: bash
       run: |
-        #!/bin/bash
-
-        set -euo pipefail
+        set -euxo pipefail
         bazel query ... | grep -E "tarball$" | while IFS= read -r target; do
             echo "Testing $target"
             bazel run $target

.github/workflows/main.yaml

@@ -26,6 +26,10 @@ jobs:
       labels: dre-runner-custom
     # This image is based on ubuntu:20.04
     container: ghcr.io/dfinity/dre/actions-runner:3dd4f38f076cad73fdcc68ad37fd29bed4fa3e4d
+    permissions:
+      contents: write
+      packages: write
+      pages: write
     steps:
       - uses: actions/checkout@v4
         with:

.github/workflows/msd-diff.yaml

@@ -27,7 +27,7 @@ jobs:
         uses: ./.github/workflows/manage-runner-pre
 
       - name: "📥 Download main test artifact"
-        uses: dawidd6/action-download-artifact@v6
+        uses: dawidd6/action-download-artifact@v7
         with:
           name: test-artifacts
           branch: main

.pre-commit-config.yaml

@@ -80,5 +80,4 @@ repos:
         language: script
         name: Cargo deny checks
         verbose: true
-        entry: bin/cargo-deny-checks.sh
-
+        entry: scripts/cargo-deny-checks.py