From c862724d16eb1ff0a4cd1ba7554bb8cf4e552f7e Mon Sep 17 00:00:00 2001 From: Viktor Petersson Date: Mon, 20 Jul 2026 11:07:51 +0000 Subject: [PATCH 1/7] Add dependabot config to group dependency update PRs The repo had no dependabot.yml, so Dependabot security updates ran with default settings and opened one PR per advisory. Five such PRs (#280, #283, #288, #289, #290) accumulated over three months and were only closed after the bumps had already landed via #297 and #299. Group Cargo security updates into a single PR. Version updates stay off (open-pull-requests-limit: 0) to preserve current behavior -- this repo takes CVE-driven bumps only, so enabling them would add PR volume rather than reduce it. Also add grouped GitHub Actions updates, which were not covered before. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/dependabot.yml | 34 ++++++++++++++++++++++++++++++++++ 1 file changed, 34 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 00000000..36550c95 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,34 @@ +version: 2 +updates: + # Cargo: security updates only, bundled into a single PR. + # + # This repo does not take routine version bumps -- `open-pull-requests-limit: 0` + # disables version updates while leaving Dependabot security updates enabled. + # Without the group below, each advisory opens its own PR (see #280, #283, + # #288, #289, #290, all of which sat open for months after the underlying + # bumps had already landed). + - package-ecosystem: cargo + directory: "/" + schedule: + interval: weekly + open-pull-requests-limit: 0 + groups: + cargo-security: + applies-to: security-updates + patterns: + - "*" + + # GitHub Actions: group both version and security updates into one PR each. + - package-ecosystem: github-actions + directory: "/" + schedule: + interval: weekly + groups: + actions-version: + applies-to: version-updates + patterns: + - "*" + actions-security: + applies-to: security-updates + patterns: + - "*" From 948c3b16b59e89b789da56feed8f7789f78da9ee Mon Sep 17 00:00:00 2001 From: Viktor Petersson Date: Mon, 20 Jul 2026 11:40:59 +0000 Subject: [PATCH 2/7] Replace unmaintained actions-rs/clippy-check with cargo clippy The actions-rs org has been archived since 2021 and clippy-check@v1.0.7 runs on the deprecated Node 12 runtime. Run clippy directly via rustup, which is preinstalled on the runner -- no third-party action involved. Behavior changes: - Adds -D warnings, so lints now fail the job rather than only annotating. Verified clean: `cargo clippy --all-targets --all-features -- -D warnings` passes on master. - Adds --all-targets, extending coverage to tests and benches. - Drops pull-requests: write and checks: write. Those existed so the action could post check annotations; a plain cargo step needs neither, leaving contents: read. - Adds lint.yml to its own paths filter so changes to this workflow are exercised by it. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/lint.yml | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index b7cf69d7..84eb19a2 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -7,17 +7,17 @@ on: paths: - "**.rs" - "Cargo.toml" + - ".github/workflows/lint.yml" pull_request: branches: - master paths: - "**.rs" - "Cargo.toml" + - ".github/workflows/lint.yml" permissions: contents: read - pull-requests: write - checks: write jobs: lint: @@ -33,8 +33,8 @@ jobs: - name: Install dependencies run: sudo apt -q -yy install libdbus-1-dev pkg-config libdbus-1-3 libsystemd0 libsystemd-dev - - name: rust-clippy-check - uses: actions-rs/clippy-check@v1.0.7 - with: - token: ${{ secrets.GITHUB_TOKEN }} - args: --manifest-path Cargo.toml + - name: Install clippy + run: rustup component add clippy + + - name: Run clippy + run: cargo clippy --manifest-path Cargo.toml --all-targets -- -D warnings From ee98579a9077b087b767fa4a09315c22b463c7bd Mon Sep 17 00:00:00 2001 From: Viktor Petersson Date: Mon, 20 Jul 2026 11:44:36 +0000 Subject: [PATCH 3/7] Pin all third-party actions to commit SHAs No action in the repo was pinned by digest. Four ran from mutable branch refs -- dtolnay/rust-toolchain@master, @nightly, sbomify/github-action@master, and DeterminateSystems/flakehub-cache-action@main -- meaning any upstream push executed automatically. Two of those run in release.yml and sbom.yml, which build and attest release artifacts. Pin every third-party action to a full commit SHA with the previous ref retained as a trailing comment. Dependabot updates digest pins and maintains those comments, and the github-actions grouping added earlier in this branch keeps the churn to one PR. Versions are unchanged -- each SHA is the current tip of the ref already in use, so this is a hardening change with no behavior difference. screenly/cli@master is intentionally left unpinned: actions.yml is an integration test that exercises the CLI at master by design. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/actions.yml | 2 +- .github/workflows/docs.yml | 8 ++++---- .github/workflows/fmt.yml | 4 ++-- .github/workflows/lint.yml | 2 +- .github/workflows/nix.yml | 6 +++--- .github/workflows/release.yml | 12 ++++++------ .github/workflows/rust.yml | 4 ++-- .github/workflows/sbom.yml | 6 +++--- 8 files changed, 22 insertions(+), 22 deletions(-) diff --git a/.github/workflows/actions.yml b/.github/workflows/actions.yml index c233f295..f43f0391 100644 --- a/.github/workflows/actions.yml +++ b/.github/workflows/actions.yml @@ -8,7 +8,7 @@ jobs: runs-on: ubuntu-latest name: List screens steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 - id: list-screens uses: screenly/cli@master with: diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index 16886a61..6240e354 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -20,8 +20,8 @@ jobs: docs_command_line_help: ${{ steps.filter.outputs.docs_command_line_help }} docs_edge_apps: ${{ steps.filter.outputs.docs_edge_apps }} steps: - - uses: actions/checkout@v4 - - uses: dorny/paths-filter@v3 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + - uses: dorny/paths-filter@d1c1ffe0248fe513906c8e24db8ea791d46f8590 # v3 id: filter with: list-files: shell @@ -40,10 +40,10 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v3 + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3 - name: Install Rust - uses: dtolnay/rust-toolchain@master + uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c # master with: toolchain: stable target: x86_64-unknown-linux-gnu diff --git a/.github/workflows/fmt.yml b/.github/workflows/fmt.yml index d30b1bca..3b45d786 100644 --- a/.github/workflows/fmt.yml +++ b/.github/workflows/fmt.yml @@ -12,11 +12,11 @@ jobs: runs-on: ubuntu-latest steps: - name: Check out Git repository - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 with: submodules: recursive ssh-key: ${{ secrets.SSH_PRIVATE_KEY }} - - uses: dtolnay/rust-toolchain@nightly + - uses: dtolnay/rust-toolchain@4fd1da8b0805d2d2e936788875a7d65dbd677dc2 # nightly with: components: rustfmt diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index 84eb19a2..aeb94a4d 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -25,7 +25,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Check out Git repository - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 with: submodules: recursive ssh-key: ${{ secrets.SSH_PRIVATE_KEY }} diff --git a/.github/workflows/nix.yml b/.github/workflows/nix.yml index fa4f7ac7..2b744cd8 100644 --- a/.github/workflows/nix.yml +++ b/.github/workflows/nix.yml @@ -33,13 +33,13 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Checkout flake - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 - name: Install nix - uses: DeterminateSystems/nix-installer-action@v22 + uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22 - name: Setup FlakeHub Cache - uses: DeterminateSystems/flakehub-cache-action@main + uses: DeterminateSystems/flakehub-cache-action@3be0931021788e3bb4df65f59a555039c2fa2d46 # main - name: Build screenly-cli run: nix build .#screenly-cli diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 02cea212..d0cceedd 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -65,10 +65,10 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v3 + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3 - name: Install Rust - uses: dtolnay/rust-toolchain@master + uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c # master with: toolchain: ${{ matrix.rust }} target: ${{ matrix.target }} @@ -106,7 +106,7 @@ jobs: cd - - name: Publish - uses: softprops/action-gh-release@v1 + uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v1 # TODO: if any of the build step fails, the release should be deleted. with: files: "screenly*" @@ -114,7 +114,7 @@ jobs: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - name: Attest - uses: actions/attest-build-provenance@v1 + uses: actions/attest-build-provenance@ef244123eb79f2f7a7e75d99086184180e6d0018 # v1 with: subject-path: "${{ github.workspace }}/screenly*" @@ -125,7 +125,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout repository - uses: actions/checkout@v3 + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3 - name: Build container run: | @@ -141,7 +141,7 @@ jobs: - name: Login to DockerHub if: success() && github.event_name != 'pull_request' - uses: docker/login-action@v3 + uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3 with: username: ${{ secrets.DOCKER_USERNAME }} password: ${{ secrets.DOCKER_PASSWORD }} diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml index d64f6cd7..29a1246d 100644 --- a/.github/workflows/rust.yml +++ b/.github/workflows/rust.yml @@ -31,10 +31,10 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 - name: Cache Cargo & target directories - uses: actions/cache@v4 + uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4 with: path: | ~/.cargo/bin/ diff --git a/.github/workflows/sbom.yml b/.github/workflows/sbom.yml index 6d50ee98..4c9f1d70 100644 --- a/.github/workflows/sbom.yml +++ b/.github/workflows/sbom.yml @@ -14,10 +14,10 @@ jobs: attestations: write runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 - name: Upload SBOM - uses: sbomify/github-action@master + uses: sbomify/github-action@e7848bb19cfcd770b8f06b985603cdd0ec0e0be2 # master env: TOKEN: ${{ secrets.SBOMIFY_TOKEN }} COMPONENT_ID: 'UUzAdk8ixV' @@ -29,6 +29,6 @@ jobs: ENRICH: true - name: Attest - uses: actions/attest-build-provenance@v1 + uses: actions/attest-build-provenance@ef244123eb79f2f7a7e75d99086184180e6d0018 # v1 with: subject-path: '${{ github.workspace }}/cli.cdx.json' From 85557c8364521525ed12a9f046c3f0dadce00bee Mon Sep 17 00:00:00 2001 From: Viktor Petersson Date: Mon, 20 Jul 2026 11:45:56 +0000 Subject: [PATCH 4/7] Replace dtolnay/rust-toolchain with rustup in docs and release Drop the third-party toolchain action from docs.yml and release.yml in favor of rustup, which is preinstalled on the ubuntu-22.04 and macos-15 runners these jobs use. The action's toolchain/target inputs map directly onto rustup commands, so the matrix in release.yml keeps installing the same per-target toolchains it did before. fmt.yml still uses the action, since that job needs a nightly toolchain for the unstable options in rustfmt.toml. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/docs.yml | 8 ++++---- .github/workflows/release.yml | 8 ++++---- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index 6240e354..0ed76b01 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -43,10 +43,10 @@ jobs: uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3 - name: Install Rust - uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c # master - with: - toolchain: stable - target: x86_64-unknown-linux-gnu + run: | + rustup toolchain install stable --profile minimal + rustup default stable + rustup target add x86_64-unknown-linux-gnu - name: Generate documentation run: cargo run -- print-help-markdown > /tmp/CommandLineHelp.md diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index d0cceedd..14149f2b 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -68,10 +68,10 @@ jobs: uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3 - name: Install Rust - uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c # master - with: - toolchain: ${{ matrix.rust }} - target: ${{ matrix.target }} + run: | + rustup toolchain install ${{ matrix.rust }} --profile minimal + rustup default ${{ matrix.rust }} + rustup target add ${{ matrix.target }} - name: Use Cross shell: bash From 242956b4a08419cd6814fcaf3edf047bb7b7eeb9 Mon Sep 17 00:00:00 2001 From: Viktor Petersson Date: Mon, 20 Jul 2026 11:50:18 +0000 Subject: [PATCH 5/7] Use stable rustfmt and stop failing lint on clippy warnings Drop dtolnay/rust-toolchain from fmt.yml, the last remaining use. The job now runs stable rustfmt via rustup. The unstable options in rustfmt.toml (group_imports, imports_granularity, format_generated_files) are ignored on stable with a warning; `cargo fmt --all --check` passes either way, so the check still catches ordinary formatting drift. Also revert the -D warnings flag added earlier in this branch. The CI runner ships clippy 1.97, which has useless_borrows_in_formatting; that lint fires 19 times in src/ and turned the lint job red. Those warnings predate this branch -- the old actions-rs step only annotated them. Restoring the non-blocking behavior keeps this branch to CI plumbing rather than mixing in src/ changes. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/fmt.yml | 5 ++--- .github/workflows/lint.yml | 2 +- 2 files changed, 3 insertions(+), 4 deletions(-) diff --git a/.github/workflows/fmt.yml b/.github/workflows/fmt.yml index 3b45d786..e5beb621 100644 --- a/.github/workflows/fmt.yml +++ b/.github/workflows/fmt.yml @@ -16,9 +16,8 @@ jobs: with: submodules: recursive ssh-key: ${{ secrets.SSH_PRIVATE_KEY }} - - uses: dtolnay/rust-toolchain@4fd1da8b0805d2d2e936788875a7d65dbd677dc2 # nightly - with: - components: rustfmt + - name: Install rustfmt + run: rustup component add rustfmt - name: Run rustfmt check id: fmt diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index aeb94a4d..6eaf49ed 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -37,4 +37,4 @@ jobs: run: rustup component add clippy - name: Run clippy - run: cargo clippy --manifest-path Cargo.toml --all-targets -- -D warnings + run: cargo clippy --manifest-path Cargo.toml --all-targets From d3ef39a74091d3c0cd35ca8c8a01ecb0501c5abb Mon Sep 17 00:00:00 2001 From: Viktor Petersson Date: Mon, 20 Jul 2026 11:56:15 +0000 Subject: [PATCH 6/7] Fix redundant references in formatting macros Remove 19 redundant `&` in format!, debug!, and println! arguments across six files, applied via `cargo clippy --fix`. Formatting traits auto-deref, so these are inert -- 19 insertions, 19 deletions, no behavior change. The lint (useless_borrows_in_formatting) has been firing since clippy 1.97 but went unnoticed because the old actions-rs step only annotated warnings rather than failing on them. With the tree clean, restore -D warnings on the clippy step so these cannot silently accumulate again. Verified against clippy 1.97.1, which matches the 1.97 the runner ships. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/lint.yml | 2 +- src/api/edge_app/setting.rs | 4 ++-- src/commands/asset.rs | 4 ++-- src/commands/edge_app/app.rs | 10 +++++----- src/commands/edge_app/utils.rs | 2 +- src/commands/mod.rs | 16 ++++++++-------- src/commands/screen.rs | 2 +- 7 files changed, 20 insertions(+), 20 deletions(-) diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index 6eaf49ed..aeb94a4d 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -37,4 +37,4 @@ jobs: run: rustup component add clippy - name: Run clippy - run: cargo clippy --manifest-path Cargo.toml --all-targets + run: cargo clippy --manifest-path Cargo.toml --all-targets -- -D warnings diff --git a/src/api/edge_app/setting.rs b/src/api/edge_app/setting.rs index a749fc59..2658e266 100644 --- a/src/api/edge_app/setting.rs +++ b/src/api/edge_app/setting.rs @@ -329,7 +329,7 @@ impl Api { payload.insert("app_id".to_owned(), json!(app_id)); payload.insert("name".to_owned(), json!(setting.name)); - debug!("Creating setting: {:?}", &payload); + debug!("Creating setting: {:?}", payload); commands::post(&self.authentication, "v4.1/edge-apps/settings", &payload) } @@ -338,7 +338,7 @@ impl Api { let mut payload = serde_json::from_value::>(value)?; payload.insert("name".to_owned(), json!(setting.name)); - debug!("Updating setting: {:?}", &payload); + debug!("Updating setting: {:?}", payload); commands::patch( &self.authentication, diff --git a/src/commands/asset.rs b/src/commands/asset.rs index 50f4496d..65034aa6 100644 --- a/src/commands/asset.rs +++ b/src/commands/asset.rs @@ -57,7 +57,7 @@ impl AssetCommand { } pub fn add(&self, path: &str, title: &str) -> anyhow::Result { - let url = format!("{}/v4/assets", &self.authentication.config.url); + let url = format!("{}/v4/assets", self.authentication.config.url); let mut headers = HeaderMap::new(); headers.insert("Prefer", "return=representation".parse()?); @@ -130,7 +130,7 @@ impl AssetCommand { } let headers = assets[0].get("headers").ok_or(CommandError::MissingField)?; let old_headers = serde_json::from_value::>(headers.clone())?; - debug!("Old headers {:?}", &old_headers); + debug!("Old headers {:?}", old_headers); for (key, value) in old_headers { new_headers.entry(key).or_insert(value); } diff --git a/src/commands/edge_app/app.rs b/src/commands/edge_app/app.rs index d5ed98d4..c8c7ba37 100644 --- a/src/commands/edge_app/app.rs +++ b/src/commands/edge_app/app.rs @@ -252,7 +252,7 @@ impl EdgeAppCommand { .api .get_version_asset_signatures(&actual_app_id, revision)?; let changed_files = detect_changed_files(&local_files, &remote_files)?; - debug!("Changed files: {:?}", &changed_files); + debug!("Changed files: {:?}", changed_files); let remote_settings = self.api.get_settings(&actual_app_id)?; @@ -421,7 +421,7 @@ impl EdgeAppCommand { } debug!( "ensure_assets_processing_finished: {:?}", - &asset_processing_statuses + asset_processing_statuses ); for asset_processing_status in &asset_processing_statuses { @@ -554,7 +554,7 @@ impl EdgeAppCommand { setting: &Setting, prompt_user: bool, ) -> Result<(), CommandError> { - debug!("Deleting setting: {:?}", &setting.name); + debug!("Deleting setting: {:?}", setting.name); let mut input_name = String::new(); @@ -627,7 +627,7 @@ impl EdgeAppCommand { path: &Path, _pb: &Arc>, ) -> Result<(), CommandError> { - let url = format!("{}/v4/assets", &self.api.authentication.config.url); + let url = format!("{}/v4/assets", self.api.authentication.config.url); let mut headers = HeaderMap::new(); headers.insert("Prefer", "return=representation".parse()?); @@ -659,7 +659,7 @@ impl EdgeAppCommand { let status = response.status(); if status != StatusCode::CREATED { - debug!("Response: {:?}", &response.text()); + debug!("Response: {:?}", response.text()); return Err(CommandError::WrongResponseStatus(status.as_u16())); } diff --git a/src/commands/edge_app/utils.rs b/src/commands/edge_app/utils.rs index 5b78aa46..6419b472 100644 --- a/src/commands/edge_app/utils.rs +++ b/src/commands/edge_app/utils.rs @@ -273,7 +273,7 @@ pub fn generate_file_tree(files: &[EdgeAppFile], root_path: &Path) -> HashMap Result { - let url = format!("{}/{}", &authentication.config.url, endpoint); + let url = format!("{}/{}", authentication.config.url, endpoint); debug!("GET {url}"); let mut headers = HeaderMap::new(); headers.insert("Prefer", "return=representation".parse()?); @@ -189,7 +189,7 @@ pub fn get( debug!("GET {url} -> {status}"); if status != StatusCode::OK { - println!("Response: {:?}", &response.text()); + println!("Response: {:?}", response.text()); return Err(CommandError::WrongResponseStatus(status.as_u16())); } Ok(serde_json::from_str(&response.text()?)?) @@ -200,7 +200,7 @@ pub fn post( endpoint: &str, payload: &T, ) -> Result { - let url = format!("{}/{}", &authentication.config.url, endpoint); + let url = format!("{}/{}", authentication.config.url, endpoint); let mut headers = HeaderMap::new(); headers.insert("Prefer", "return=representation".parse()?); @@ -216,7 +216,7 @@ pub fn post( // Ok, No_Content are acceptable because some of our RPC code returns that. if ![StatusCode::CREATED, StatusCode::OK, StatusCode::NO_CONTENT].contains(&status) { - debug!("Response: {:?}", &response.text()?); + debug!("Response: {:?}", response.text()?); return Err(CommandError::WrongResponseStatus(status.as_u16())); } if status == StatusCode::NO_CONTENT { @@ -227,13 +227,13 @@ pub fn post( } pub fn delete(authentication: &Authentication, endpoint: &str) -> anyhow::Result<(), CommandError> { - let url = format!("{}/{}", &authentication.config.url, endpoint); + let url = format!("{}/{}", authentication.config.url, endpoint); let response = authentication.build_client()?.delete(url).send()?; let status = response.status(); if ![StatusCode::OK, StatusCode::NO_CONTENT].contains(&status) { - debug!("Response: {:?}", &response.text()?); + debug!("Response: {:?}", response.text()?); return Err(CommandError::WrongResponseStatus(status.as_u16())); } Ok(()) @@ -244,7 +244,7 @@ pub fn patch( endpoint: &str, payload: &T, ) -> anyhow::Result { - let url = format!("{}/{}", &authentication.config.url, endpoint); + let url = format!("{}/{}", authentication.config.url, endpoint); let mut headers = HeaderMap::new(); headers.insert("Prefer", "return=representation".parse()?); @@ -257,7 +257,7 @@ pub fn patch( let status = response.status(); if status != StatusCode::OK { - debug!("Response: {:?}", &response.text()?); + debug!("Response: {:?}", response.text()?); return Err(CommandError::WrongResponseStatus(status.as_u16())); } diff --git a/src/commands/screen.rs b/src/commands/screen.rs index 15f32c2c..8e784b46 100644 --- a/src/commands/screen.rs +++ b/src/commands/screen.rs @@ -36,7 +36,7 @@ impl ScreenCommand { pin: &str, maybe_name: Option, ) -> anyhow::Result { - let url = format!("{}/v3/screens/", &self.authentication.config.url); + let url = format!("{}/v3/screens/", self.authentication.config.url); let mut payload = HashMap::new(); payload.insert("pin".to_string(), pin.to_string()); if let Some(name) = maybe_name { From 8094ad1cb0bed050fcfc7012b712947b26590962 Mon Sep 17 00:00:00 2001 From: Viktor Petersson Date: Mon, 20 Jul 2026 14:20:39 +0000 Subject: [PATCH 7/7] Upgrade remaining outdated actions - actions/checkout v3 -> v4 in docs.yml and release.yml, matching the other workflows. v3 runs on deprecated Node 16. - softprops/action-gh-release v1 -> v3.0.2. Also a Node 16 action; v3 runs Node 24. Input-compatible: every input this workflow uses (files, plus the GITHUB_TOKEN env) still exists in v3. - sbomify/github-action master -> v26.7.0, moving off an untagged branch tip onto the latest release. action.yml is byte-identical between the two, so the interface is unchanged. - flakehub-cache-action comment corrected to # v3.21.7. The pinned SHA is already identical to that tag, so only the comment was wrong. Note that pinning sbomify/github-action is largely cosmetic: its action.yml runs docker://ghcr.io/sbomify/sbomify-action:latest, a mutable tag, so the executed code is whatever :latest resolves to regardless of the ref pinned here. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/docs.yml | 2 +- .github/workflows/nix.yml | 2 +- .github/workflows/release.yml | 6 +++--- .github/workflows/sbom.yml | 2 +- 4 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index 0ed76b01..475b11a2 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -40,7 +40,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 - name: Install Rust run: | diff --git a/.github/workflows/nix.yml b/.github/workflows/nix.yml index 2b744cd8..29eb7cb9 100644 --- a/.github/workflows/nix.yml +++ b/.github/workflows/nix.yml @@ -39,7 +39,7 @@ jobs: uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22 - name: Setup FlakeHub Cache - uses: DeterminateSystems/flakehub-cache-action@3be0931021788e3bb4df65f59a555039c2fa2d46 # main + uses: DeterminateSystems/flakehub-cache-action@3be0931021788e3bb4df65f59a555039c2fa2d46 # v3.21.7 - name: Build screenly-cli run: nix build .#screenly-cli diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 14149f2b..af134c5e 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -65,7 +65,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 - name: Install Rust run: | @@ -106,7 +106,7 @@ jobs: cd - - name: Publish - uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v1 + uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2 # TODO: if any of the build step fails, the release should be deleted. with: files: "screenly*" @@ -125,7 +125,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout repository - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 - name: Build container run: | diff --git a/.github/workflows/sbom.yml b/.github/workflows/sbom.yml index 4c9f1d70..0a2292cc 100644 --- a/.github/workflows/sbom.yml +++ b/.github/workflows/sbom.yml @@ -17,7 +17,7 @@ jobs: - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 - name: Upload SBOM - uses: sbomify/github-action@e7848bb19cfcd770b8f06b985603cdd0ec0e0be2 # master + uses: sbomify/github-action@ddf6a0d3d75b645153ad1ad60034b3fe2cb1eb63 # v26.7.0 env: TOKEN: ${{ secrets.SBOMIFY_TOKEN }} COMPONENT_ID: 'UUzAdk8ixV'