coderbants · coderbants · Aug 28, 2026 · Aug 28, 2026 · Aug 28, 2026 · Aug 28, 2026
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -20,19 +20,23 @@ jobs:
     name: Version Change Required
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
         with:
           fetch-depth: 0
+          persist-credentials: false
       - name: Verify version matches upstream
         run: scripts/verify_upstream_version.sh
   gate:
     name: Lint / Build / Doc / Tests
     runs-on: ubuntu-latest
     needs: version-bump
     steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
         with:
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772
+        with:
+          toolchain: 1.98.0
           components: clippy, rustfmt
       - name: Configure shared Cargo cache
         run: |
@@ -51,49 +55,56 @@ jobs:
           } >> "$GITHUB_ENV"
       - name: Test shared Cargo cache env
         run: scripts/test-cargo-env.sh
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5
         with:
           go-version: 'stable'
       - name: Fetch upstream Go source (pinned)
         run: |
-          git clone --quiet https://github.com/charmbracelet/bubbles.git upstream-go
-          cd upstream-go && git checkout --quiet v2.1.0
+          git clone --quiet --no-tags https://github.com/charmbracelet/bubbles.git upstream-go
+          cd upstream-go
+          git checkout --quiet f1daacfa0cfee07e31a12498078426d275aa5286
       - name: Fetch sibling rusty-bubbletea (pinned)
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
         with:
           repository: coderbants/rusty-bubbletea
           path: siblings/rusty-bubbletea
-          ref: dev
+          ref: df1c3b83ae4fe61b57de8194b487732db342468e
+          persist-credentials: false
       - name: Fetch sibling rusty-colorprofile (pinned)
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
         with:
           repository: coderbants/rusty-colorprofile
           path: siblings/rusty-colorprofile
-          ref: dev
+          ref: 2d505e7821f72f133c17d6cc7afd314e03eddb66
+          persist-credentials: false
       - name: Fetch sibling rusty-lipgloss (pinned)
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
         with:
           repository: coderbants/rusty-lipgloss
           path: siblings/rusty-lipgloss
-          ref: dev
+          ref: 685b25da2af226b6ab2b9ce70f149eb9e4fb54ee
+          persist-credentials: false
       - name: Fetch sibling rusty-testkit (pinned)
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
         with:
           repository: coderbants/rusty-testkit
           path: siblings/rusty-testkit
-          ref: dev
+          ref: 163cf16399662da7bf2b17fb6637b466c6402fb2
+          persist-credentials: false
       - name: Fetch sibling rusty-ultraviolet (pinned)
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
         with:
           repository: coderbants/rusty-ultraviolet
           path: siblings/rusty-ultraviolet
-          ref: dev
+          ref: 934257fbfc39cb4e42eb3f88c5e32ab4c32753b0
+          persist-credentials: false
       - name: Fetch sibling rusty-x-ansi (pinned)
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
         with:
           repository: coderbants/rusty-x-ansi
           path: siblings/rusty-x-ansi
-          ref: dev
+          ref: 971128e8566ad37991cd9cc50ff4f4c8a4b09c29
+          persist-credentials: false
       - name: Place sibling crates
         run: |
           mkdir -p ../siblings && true
@@ -115,15 +126,19 @@ jobs:
         run: cargo test --all-targets
       - name: verify_mapping
         run: ./scripts/verify_mapping.sh
+      - name: test_release_guards
+        run: ./scripts/test-release-guards.sh
   coverage:
     name: Coverage
     runs-on: ubuntu-latest
     needs: gate
-    permissions:
-      contents: write
     steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772
+        with:
+          toolchain: 1.98.0
       - name: Configure shared Cargo cache
         run: |
           # The runner image pre-sets CARGO_HOME=$HOME/.cargo; drop the
@@ -139,41 +154,47 @@ jobs:
             echo "CARGO_INSTALL_ROOT=$CARGO_INSTALL_ROOT"
           } >> "$GITHUB_ENV"
       - name: Fetch sibling rusty-bubbletea (pinned)
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
         with:
           repository: coderbants/rusty-bubbletea
           path: siblings/rusty-bubbletea
-          ref: dev
+          ref: df1c3b83ae4fe61b57de8194b487732db342468e
+          persist-credentials: false
       - name: Fetch sibling rusty-colorprofile (pinned)
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
         with:
           repository: coderbants/rusty-colorprofile
           path: siblings/rusty-colorprofile
-          ref: dev
+          ref: 2d505e7821f72f133c17d6cc7afd314e03eddb66
+          persist-credentials: false
       - name: Fetch sibling rusty-lipgloss (pinned)
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
         with:
           repository: coderbants/rusty-lipgloss
           path: siblings/rusty-lipgloss
-          ref: dev
+          ref: 685b25da2af226b6ab2b9ce70f149eb9e4fb54ee
+          persist-credentials: false
       - name: Fetch sibling rusty-testkit (pinned)
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
         with:
           repository: coderbants/rusty-testkit
           path: siblings/rusty-testkit
-          ref: dev
+          ref: 163cf16399662da7bf2b17fb6637b466c6402fb2
+          persist-credentials: false
       - name: Fetch sibling rusty-ultraviolet (pinned)
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
         with:
           repository: coderbants/rusty-ultraviolet
           path: siblings/rusty-ultraviolet
-          ref: dev
+          ref: 934257fbfc39cb4e42eb3f88c5e32ab4c32753b0
+          persist-credentials: false
       - name: Fetch sibling rusty-x-ansi (pinned)
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
         with:
           repository: coderbants/rusty-x-ansi
           path: siblings/rusty-x-ansi
-          ref: dev
+          ref: 971128e8566ad37991cd9cc50ff4f4c8a4b09c29
+          persist-credentials: false
       - name: Place sibling crates
         run: |
           mkdir -p ../siblings && true
@@ -184,12 +205,39 @@ jobs:
           mv siblings/rusty-ultraviolet ../rusty-ultraviolet
           mv siblings/rusty-x-ansi ../rusty-x-ansi
       - name: Install cargo-tarpaulin
-        uses: taiki-e/install-action@cargo-tarpaulin
+        uses: taiki-e/install-action@94f54106ddd448427843411da73d6b8a35ae69b3
       - name: Generate code coverage
         run: |
+          set -o pipefail
           cargo tarpaulin --all-features --out xml --output-dir target/tarpaulin -- --test-threads=1 2>&1 | tee /tmp/tarpaulin.log
 
+      - name: Upload coverage report
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        with:
+          name: coverage-report
+          path: target/tarpaulin/cobertura.xml
+          if-no-files-found: error
+          retention-days: 1
+  coverage-badge:
+    name: Update coverage badge
+    runs-on: ubuntu-latest
+    needs: coverage
+    if: github.event_name == 'push' && github.ref == 'refs/heads/dev'
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          ref: dev
+          persist-credentials: false
+      - name: Download coverage report
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
+        with:
+          name: coverage-report
+          path: target/tarpaulin
       - name: Write coverage badge in place
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           raw="$(grep -oE 'line-rate="[0-9.]+' target/tarpaulin/cobertura.xml | head -1 | grep -oE '[0-9.]+')"
           pct="$(awk -v r="$raw" 'BEGIN { printf "%.1f", r * 100 }')"
@@ -204,13 +252,17 @@ jobs:
             *) color="red" ;;
           esac
           curl -sS "https://img.shields.io/badge/coverage-${pct}%25-${color}.svg" -o coverage.svg
-          # Commit the badge in place only when it changed (git diff ignores
-          # untracked files, so use status), so the push cannot re-trigger CI
-          # indefinitely.
-          git config user.name "github-actions[bot]"
-          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          if [ -n "$(git status --porcelain -- coverage.svg)" ]; then
-            git add coverage.svg
-            git commit -q -m "docs: update coverage badge ($pct%)"
-            git push -q origin dev
+          content="$(base64 -w 0 coverage.svg)"
+          existing_sha="$(gh api "repos/${GITHUB_REPOSITORY}/contents/coverage.svg?ref=dev" --jq .sha 2>/dev/null || true)"
+          if [ -n "$existing_sha" ]; then
+            gh api --method PUT "repos/${GITHUB_REPOSITORY}/contents/coverage.svg" \
+              --field message="docs: update coverage badge ($pct%)" \
+              --field content="$content" \
+              --field branch=dev \
+              --field sha="$existing_sha"
+          else
+            gh api --method PUT "repos/${GITHUB_REPOSITORY}/contents/coverage.svg" \
+              --field message="docs: update coverage badge ($pct%)" \
+              --field content="$content" \
+              --field branch=dev
           fi
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
@@ -4,7 +4,6 @@ on:
   push:
     tags:
       - 'v*'
-  workflow_dispatch:
 
 permissions:
   contents: write
@@ -14,8 +13,13 @@ jobs:
     name: Publish Crate
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772
+        with:
+          toolchain: 1.98.0
+          components: clippy, rustfmt
       - name: Verify version and tag match upstream
         run: scripts/verify_upstream_version.sh "$GITHUB_REF_NAME"
       - name: Configure shared Cargo cache
@@ -36,41 +40,47 @@ jobs:
       - name: Test shared Cargo cache env
         run: scripts/test-cargo-env.sh
       - name: Fetch sibling rusty-bubbletea (pinned)
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
         with:
           repository: coderbants/rusty-bubbletea
           path: siblings/rusty-bubbletea
-          ref: dev
+          ref: df1c3b83ae4fe61b57de8194b487732db342468e
+          persist-credentials: false
       - name: Fetch sibling rusty-colorprofile (pinned)
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
         with:
           repository: coderbants/rusty-colorprofile
           path: siblings/rusty-colorprofile
-          ref: dev
+          ref: 2d505e7821f72f133c17d6cc7afd314e03eddb66
+          persist-credentials: false
       - name: Fetch sibling rusty-lipgloss (pinned)
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
         with:
           repository: coderbants/rusty-lipgloss
           path: siblings/rusty-lipgloss
-          ref: dev
+          ref: 685b25da2af226b6ab2b9ce70f149eb9e4fb54ee
+          persist-credentials: false
       - name: Fetch sibling rusty-testkit (pinned)
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
         with:
           repository: coderbants/rusty-testkit
           path: siblings/rusty-testkit
-          ref: dev
+          ref: 163cf16399662da7bf2b17fb6637b466c6402fb2
+          persist-credentials: false
       - name: Fetch sibling rusty-ultraviolet (pinned)
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
         with:
           repository: coderbants/rusty-ultraviolet
           path: siblings/rusty-ultraviolet
-          ref: dev
+          ref: 934257fbfc39cb4e42eb3f88c5e32ab4c32753b0
+          persist-credentials: false
       - name: Fetch sibling rusty-x-ansi (pinned)
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
         with:
           repository: coderbants/rusty-x-ansi
           path: siblings/rusty-x-ansi
-          ref: dev
+          ref: 971128e8566ad37991cd9cc50ff4f4c8a4b09c29
+          persist-credentials: false
       - name: Place sibling crates
         run: |
           mkdir -p ../siblings && true
@@ -116,6 +126,7 @@ jobs:
           git archive --format=tar.gz -o "$RUNNER_TEMP/$src" HEAD
           gh release upload "$GITHUB_REF_NAME" "$RUNNER_TEMP/$src" --clobber
       - name: Publish to crates.io
+        if: startsWith(github.ref, 'refs/tags/v')
         env:
           CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
         run: |
@@ -131,7 +142,7 @@ jobs:
             # registry, but ultraviolet's dev-dependency on lipgloss and
             # lipgloss's dependency on ultraviolet form a cycle; the full
             # gates (build, clippy, tests) already ran above.
-            cargo publish --token "${CARGO_REGISTRY_TOKEN}" --no-verify --allow-dirty
+            cargo publish --no-verify --allow-dirty
             git checkout -- Cargo.toml
           else
             echo "No CARGO_REGISTRY_TOKEN secret; skipping crates.io publish."

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
@@ -10,7 +10,7 @@ workflow.
 
 ## Development setup
 
-- A recent stable Rust toolchain (`rustup default stable`).
+- Rust 1.98.0, selected automatically by the checked-in `rust-toolchain.toml`.
 - Go (for the upstream parity scripts and the pinned `upstream-go/` checkout).
 - No other system dependencies; there are no C build steps.
 
@@ -56,6 +56,7 @@ cargo test --all-targets
 
    ```sh
    cargo test --all-targets
+   ./scripts/test-release-guards.sh
    cargo doc --no-deps           # rustdoc coverage
    ```
 
@@ -74,20 +75,9 @@ cargo test --all-targets
 
 ## Versioning
 
-Every release that matches an upstream version uses the upstream `MAJOR.MINOR.PATCH` plus a
-fourth dot-separated iteration number that internally tracks which deployed release of this
-port it is for that upstream version:
-
-- `v2.1.0.0` — first port release of upstream `v2.1.0`
-- `v2.1.0.1` — a hotfix iteration for `v2.1.0` (bug fix released without an upstream
-  version bump)
-
-The iteration increments whenever we publish a new release of our port without an upstream
-version bump (e.g. a bug fix that upstream has not yet released). The git tag and GitHub
-release carry the full four-part version (`v2.1.0.1`). `Cargo.toml` keeps the upstream
-`X.Y.Z` (`2.1.0`), since crates.io only accepts `MAJOR.MINOR.PATCH`; iteration hotfixes
-publish under the same `X.Y.Z` on crates.io, replacing the previous deployment (iterations
-are only used for bug fixes, so the contents differ only in fixes).
+Every release uses the tracked upstream version exactly. There is no fourth-part iteration or
+republishing of an existing crates.io version; wait for an upstream version change before
+creating another release tag.
 
 ## Contribution guidelines