chore(deps): repin dunite to its merged main commit (BUNYIP-438) #426

Merged

David merged 1 commit from chore/BUNYIP-438-repin-dunite-main into main

2026-08-01 03:11:59 +02:00

David commented

2026-08-01 02:56:53 +02:00

Owner

What

Repin the four dunite git dependencies from ded4b9f (DUNITE-3's branch head) to c5730bc (dunite main), and drop the comment that said to do this once DUNITE-3 merged.

Why

BUNYIP-399 (#395) needed a dunite that runs sqlx 0.8, which at the time existed only on dunite's unmerged DUNITE-3 branch, so it pinned all four declarations at that branch's head ded4b9f. DUNITE-3 (dunite PR #20) has since merged: dunite main is now c5730bc13c25d9921b360e4afe314173fbbebfca and feat/DUNITE-3-sqlx-0.8 was deleted. ded4b9f is reachable today only because #20 landed as a merge commit rather than a squash, so it survives as an ancestor of c5730bc. Depending on a deleted topic branch's tip is a build that breaks on a future GC or history rewrite with no local signal (BUNYIP-438).

Changes

crates/bunyip-domain/Cargo.toml (dunite-core, dunite-download), crates/bunyip-oci/Cargo.toml (dunite-oci), crates/bunyip-oidc/Cargo.toml (dunite-oidc): rev = "ded4b9f..." -> rev = "c5730bc...". The rev form is kept, which scripts/check-security-invariants.sh (BUNYIP-426 F6) enforces.
Removed the now-obsolete ded4b9f is DUNITE-3's head (sqlx 0.8); repin to dunite main once it merges. comment. The surrounding BUNYIP-426 F6 rev-pin comment stays.
cargo update --package dunite-core --package dunite-download --package dunite-oci --package dunite-oidc regenerates Cargo.lock; only the four dunite source URLs move, no other package resolves differently and sqlx stays 0.8.6.

Not a dunite upgrade

Verified rather than assumed: git diff --quiet ded4b9f c5730bc in the dunite clone reports no difference, so the two revs have byte-identical trees. This is pin hygiene only, which is why no bunyip source change and no .sqlx/ regeneration was needed.

Tests

Full gate green in the pinned rust-builder-glibc image with SQLX_OFFLINE=true: cargo fmt --all --check clean, cargo clippy --workspace --all-targets -- -D warnings clean, cargo build --workspace --all-targets --locked green (lockfile consistent for CI's locked build), cargo test --workspace --all-targets 607 passed / 0 failed. All four CI invariant scripts pass: check-security-invariants.sh, check-migration-immutability.sh, check-migration-versions.sh, check-workflow-secrets.sh.

## What Repin the four dunite git dependencies from `ded4b9f` (DUNITE-3's branch head) to `c5730bc` (dunite `main`), and drop the comment that said to do this once DUNITE-3 merged. ## Why BUNYIP-399 (#395) needed a dunite that runs sqlx 0.8, which at the time existed only on dunite's unmerged DUNITE-3 branch, so it pinned all four declarations at that branch's head `ded4b9f`. DUNITE-3 (dunite PR #20) has since merged: dunite `main` is now `c5730bc13c25d9921b360e4afe314173fbbebfca` and `feat/DUNITE-3-sqlx-0.8` was deleted. `ded4b9f` is reachable today only because #20 landed as a merge commit rather than a squash, so it survives as an ancestor of `c5730bc`. Depending on a deleted topic branch's tip is a build that breaks on a future GC or history rewrite with no local signal (BUNYIP-438). ## Changes - `crates/bunyip-domain/Cargo.toml` (dunite-core, dunite-download), `crates/bunyip-oci/Cargo.toml` (dunite-oci), `crates/bunyip-oidc/Cargo.toml` (dunite-oidc): `rev = "ded4b9f..."` -> `rev = "c5730bc..."`. The `rev` form is kept, which `scripts/check-security-invariants.sh` (BUNYIP-426 F6) enforces. - Removed the now-obsolete `ded4b9f is DUNITE-3's head (sqlx 0.8); repin to dunite main once it merges.` comment. The surrounding BUNYIP-426 F6 rev-pin comment stays. - `cargo update --package dunite-core --package dunite-download --package dunite-oci --package dunite-oidc` regenerates `Cargo.lock`; only the four dunite source URLs move, no other package resolves differently and sqlx stays 0.8.6. ## Not a dunite upgrade Verified rather than assumed: `git diff --quiet ded4b9f c5730bc` in the dunite clone reports no difference, so the two revs have byte-identical trees. This is pin hygiene only, which is why no bunyip source change and no `.sqlx/` regeneration was needed. ## Tests Full gate green in the pinned rust-builder-glibc image with `SQLX_OFFLINE=true`: `cargo fmt --all --check` clean, `cargo clippy --workspace --all-targets -- -D warnings` clean, `cargo build --workspace --all-targets --locked` green (lockfile consistent for CI's locked build), `cargo test --workspace --all-targets` 607 passed / 0 failed. All four CI invariant scripts pass: check-security-invariants.sh, check-migration-immutability.sh, check-migration-versions.sh, check-workflow-secrets.sh.

David added 1 commit

2026-08-01 02:56:54 +02:00

chore(deps): repin dunite to its merged main commit

E2E PR gate / Install + reachability (no deployment secrets) (pull_request) Successful in 28s

Details

Check / fmt + clippy + build + tests (pull_request) Successful in 15m2s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

499915228b

BUNYIP-399 pinned the four dunite git deps to ded4b9f to pick up a dunite that runs sqlx 0.8, but that commit was the head of DUNITE-3's then-unmerged branch. DUNITE-3 (dunite PR #20) has since merged, dunite main is now c5730bc, and feat/DUNITE-3-sqlx-0.8 was deleted, so ded4b9f survives only as an ancestor of the merge commit. This repoints all four declarations (dunite-core, dunite-download, dunite-oci, dunite-oidc) at c5730bc and drops the comment that said to repin once DUNITE-3 landed.

The dunite trees at ded4b9f and c5730bc are byte-identical (`git diff --quiet ded4b9f c5730bc` in the dunite clone), so this is pin hygiene, not a dunite upgrade: Cargo.lock moves only the four dunite source URLs and no other package resolves differently. The rev form is preserved, which check-security-invariants.sh (BUNYIP-426 F6) enforces.

Verified in the pinned rust-builder-glibc image with SQLX_OFFLINE=true: cargo fmt --all --check clean, cargo clippy --workspace --all-targets -D warnings clean, cargo build --workspace --all-targets --locked green, cargo test --workspace --all-targets 607 passed 0 failed, and all four CI invariant scripts pass.

#BUNYIP-438

David scheduled this pull request to auto merge when all checks succeed

2026-08-01 03:08:27 +02:00