update from upstream

.devcontainer/Dockerfile

@@ -0,0 +1,8 @@
+# See here for image contents: https://github.com/microsoft/vscode-dev-containers/tree/v0.195.0/containers/rust/.devcontainer/base.Dockerfile
+# [Choice] Debian OS version (use bullseye on local arm64/Apple Silicon): buster, bullseye
+ARG VARIANT="bullseye"
+FROM mcr.microsoft.com/vscode/devcontainers/rust:1-${VARIANT}
+
+# [Optional] Uncomment this section to install additional packages.
+# RUN apt-get update && export DEBIAN_FRONTEND=noninteractive \
+#     && apt-get -y install --no-install-recommends <your-package-list-here>

.devcontainer/devcontainer.json

@@ -0,0 +1,46 @@
+// For format details, see https://aka.ms/vscode-remote/devcontainer.json or this file's README at:
+// https://github.com/microsoft/vscode-dev-containers/tree/v0.195.0/containers/rust
+{
+    "name": "Rust",
+    "build": {
+        "dockerfile": "Dockerfile",
+        "args": {
+            // Use the VARIANT arg to pick a Debian OS version: buster, bullseye
+            // Use bullseye when on local on arm64/Apple Silicon.
+            "VARIANT": "bullseye"
+        }
+    },
+    "runArgs": [
+        "--cap-add=SYS_PTRACE",
+        "--security-opt",
+        "seccomp=unconfined"
+    ],
+    // Configure tool-specific properties.
+    "customizations": {
+        // Configure properties specific to VS Code.
+        "vscode": {
+            // Set *default* container specific settings.json values on container create.
+            "settings": {
+                "lldb.executable": "/usr/bin/lldb",
+                // VS Code don't watch files under ./target
+                "files.watcherExclude": {
+                    "**/target/**": true
+                }
+            },
+            // Add the IDs of extensions you want installed when the container is created.
+            "extensions": [
+                "vadimcn.vscode-lldb",
+                "mutantdino.resourcemonitor",
+                "rust-lang.rust-analyzer",
+                "tamasfe.even-better-toml",
+                "serayuzgur.crates"
+            ]
+        }
+    },
+    // Use 'forwardPorts' to make a list of ports inside the container available locally.
+    // "forwardPorts": [],
+    // Use 'postCreateCommand' to run commands after the container is created.
+    // "postCreateCommand": "rustc --version",
+    // Comment out to run as root instead.
+    "remoteUser": "vscode"
+}

.github/workflows/build.yaml → .github/workflows/build.yml

@@ -156,41 +156,51 @@ jobs:
         run: |
           rustup component add llvm-tools-preview
 
+      - name: Get binstall
+        shell: bash
+        run: |
+          archive="cargo-binstall-x86_64-unknown-linux-musl.tgz"
+          wget "https://github.com/ryankurte/cargo-binstall/releases/latest/download/${archive}"
+
+          tar -xvf "./${archive}"
+
+          rm "./${archive}"
+
+          mv ./cargo-binstall ~/.cargo/bin/
+
       - name: Install nextest, custom test runner, with native support for junit
         shell: bash
         run: |
-          cargo install --locked cargo-nextest;
+          cargo binstall --no-confirm cargo-nextest;
 
       - name: Install grcov
         shell: bash
         run: |
-          cargo install --locked grcov;
+          cargo binstall --no-confirm grcov --pkg-url "{ repo }/releases/download/v{ version }/{ name }-{ target }.tar.bz2" --pkg-fmt tbz2 --bin-dir "{ bin }";
 
       - name: Build with instrumentation support
         shell: bash
         env:
-          RUSTC_BOOTSTRAP: 1
-          RUSTFLAGS: "-Zinstrument-coverage"
+          RUSTFLAGS: "-C instrument-coverage"
         run: |
           cargo build --all-targets --workspace --verbose
 
       - name: Run nextest
         shell: bash
         id: tests
         env:
-          RUSTC_BOOTSTRAP: 1
-          RUSTFLAGS: "-Zinstrument-coverage"
+          RUSTFLAGS: "-C instrument-coverage"
           LLVM_PROFILE_FILE: "profiling/profile-%p-%m.profraw"
         run: |
           cargo nextest run --profile ci --no-fail-fast --all-targets --workspace
         continue-on-error: true
 
       - name: Upload test results
-        uses: EnricoMi/publish-unit-test-result-action@f00bb47e1d89c6d98071d1b69e16a2b63c7fbfc1
+        uses: EnricoMi/publish-unit-test-result-action@7a453e7e81ac3190db44d6a0cf3ab2811b12cf11
         with:
           check_name: Test results
           github_token: ${{ secrets.GITHUB_TOKEN }}
-          files: reports/results.xml
+          junit_files: reports/results.xml
 
       - name: Run grcov
         shell: bash
@@ -270,7 +280,8 @@ jobs:
 
           cargo --version
 
-      - uses: actions-rs/clippy-check@b5b5f21f4797c02da247df37026fcd0a5024aa4d
+      - name: Run Clippy for GitHub Actions report
+        uses: actions-rs/clippy-check@b5b5f21f4797c02da247df37026fcd0a5024aa4d
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           args: --workspace --all-targets --all-features

.github/workflows/dependabot.yml

@@ -17,19 +17,19 @@ jobs:
           github-token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Approve PR
-        if: ${{steps.metadata.outputs.update-type != 'version-update:semver-major'}}
-        env:
-          PR_URL: ${{github.event.pull_request.html_url}}
-          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
+        if: ${{ steps.metadata.outputs.update-type != 'version-update:semver-major' }}
         shell: bash
+        env:
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           gh pr review --approve "$PR_URL"
 
       - name: Auto-merge
-        if: ${{steps.metadata.outputs.update-type != 'version-update:semver-major'}}
+        if: ${{ steps.metadata.outputs.update-type != 'version-update:semver-major' }}
         env:
-          PR_URL: ${{github.event.pull_request.html_url}}
-          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         shell: bash
         run: |
           gh pr merge --auto --merge "$PR_URL"

.github/workflows/lint-commits.yaml → .github/workflows/lint-commits.yml

@@ -44,9 +44,22 @@ jobs:
 
           cargo --version
 
-      - name: Install cocogitto for commit linting
+      - name: Get binstall
+        shell: bash
+        run: |
+          archive="cargo-binstall-x86_64-unknown-linux-musl.tgz"
+          wget "https://github.com/ryankurte/cargo-binstall/releases/latest/download/${archive}"
+
+          tar -xvf "./${archive}"
+
+          rm "./${archive}"
+
+          mv ./cargo-binstall ~/.cargo/bin/
+
+      - name: Install cocogitto to get the next version number
+        shell: bash
         run: |
-          cargo install --locked cocogitto;
+          cargo binstall --no-confirm cocogitto --pkg-url "{ repo }/releases/download/{ version }/{ name }-{ version }-{ target }.tar.gz" --bin-dir "{ bin }";
 
       - name: Check the commits
         shell: bash

.github/workflows/semgrep.yml

@@ -0,0 +1,41 @@
+name: Semgrep
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: "41 3 * * 6"
+
+permissions:
+  security-events: write
+  actions: read
+  contents: read
+
+jobs:
+  semgrep:
+    name: Scan
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check out repo
+        uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
+
+      - name: Install Semgrep
+        shell: bash
+        run: |
+          brew install semgrep
+
+      - name: Run Semgrep
+        shell: bash
+        env:
+          SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}
+        run: |
+          semgrep scan --sarif --output=semgrep.sarif --config=auto
+
+      - name: Upload SARIF file for GitHub Advanced Security Dashboard
+        if: always()
+        uses: github/codeql-action/upload-sarif@3f62b754e23e0dd60f91b744033e1dc1654c0ec6
+        with:
+          sarif_file: semgrep.sarif

.github/workflows/yml-lint.yml

@@ -1,9 +1,5 @@
 name: Lint Yaml
 
-# **What it does**: This lints our yaml files in the docs repository.
-# **Why we have it**: We want some level of consistent formatting for YAML files.
-# **Who does it impact**: Docs engineering, docs content.
-
 on:
   workflow_dispatch:
   push:
@@ -38,4 +34,6 @@ jobs:
           npm ci --ignore-scripts
 
       - name: Run linter
-        run: npx --no-install prettier -c "**/*.{yml,yaml}"
+        shell: bash
+        run: |
+          npx --no-install prettier -c "**/*.{yml,yaml}"

.prettierignore

@@ -1 +1 @@
-.github/actions/
+.github/actions/

.vscode/extensions.json

@@ -1,7 +1,7 @@
 {
     "recommendations": [
         "usernamehw.errorlens",
-        "matklad.rust-analyzer",
+        "rust-lang.rust-analyzer",
         "swellaby.vscode-rust-test-adapter"
     ]
 }