From 3925ad9b52b1f7693c16a25046e5fec0a7c42ade Mon Sep 17 00:00:00 2001 From: Alfie Fresta Date: Tue, 14 Jul 2026 18:08:21 +0000 Subject: [PATCH] chore(ci): bump pinned toolchain to rust 1.97.0 Now the toolchain is pinned we can move it on purpose. Bump to 1.97.0 and fix the 13 clippy warnings it brings. They are all the same one: a redundant & in a println! or write! argument. Formatting takes its arguments by reference anyway, so nothing changes at runtime. Pinning keeps CI predictable, but on its own it hides drift. Add a latest stable job that runs the same checks as the pinned build job, on master and weekly but never on pull requests, so it warns us without blocking anyone. That replaces rust-clippy.yml, which has never worked. It does not install the system dependencies, so libdbus-sys panics in its build script, the workspace never compiles and clippy lints nothing. It reported success anyway, because the step exits with the status of sarif-fmt rather than clippy, and it has been uploading empty results ever since. There are no code scanning alerts to lose. --- .github/workflows/rust-clippy.yml | 56 ------------------- .github/workflows/rust-latest.yml | 47 ++++++++++++++++ .github/workflows/rust.yml | 4 +- libwebauthn-tests/tests/basic_ctap1.rs | 2 +- libwebauthn-tests/tests/basic_ctap2.rs | 2 +- libwebauthn/examples/ceremony/u2f_nfc.rs | 2 +- libwebauthn/examples/ceremony/webauthn_ble.rs | 2 +- libwebauthn/examples/ceremony/webauthn_hid.rs | 2 +- libwebauthn/examples/features/prf_replay.rs | 2 +- .../features/webauthn_extensions_hid.rs | 2 +- .../examples/features/webauthn_prf_hid.rs | 2 +- .../features/webauthn_related_origins_hid.rs | 2 +- .../management/authenticator_config_hid.rs | 2 +- .../management/cred_management_hid.rs | 2 +- .../persistent_cred_management_hid.rs | 2 +- .../src/transport/cable/known_devices.rs | 2 +- 16 files changed, 62 insertions(+), 71 deletions(-) delete mode 100644 .github/workflows/rust-clippy.yml create mode 100644 .github/workflows/rust-latest.yml diff --git a/.github/workflows/rust-clippy.yml b/.github/workflows/rust-clippy.yml deleted file mode 100644 index 1c8ddab0..00000000 --- a/.github/workflows/rust-clippy.yml +++ /dev/null @@ -1,56 +0,0 @@ -# This workflow uses actions that are not certified by GitHub. -# They are provided by a third-party and are governed by -# separate terms of service, privacy policy, and support -# documentation. -# rust-clippy is a tool that runs a bunch of lints to catch common -# mistakes in your Rust code and help improve your Rust code. -# More details at https://github.com/rust-lang/rust-clippy -# and https://rust-lang.github.io/rust-clippy/ - -name: rust-clippy analyze - -on: - push: - branches: [ "master" ] - pull_request: - # The branches below must be a subset of the branches above - branches: [ "master" ] - schedule: - - cron: '37 10 * * 6' - -jobs: - rust-clippy-analyze: - name: Run rust-clippy analyzing - runs-on: ubuntu-latest - permissions: - contents: read - security-events: write - actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status - steps: - - name: Checkout code - uses: actions/checkout@v2 - - - name: Install Rust toolchain - uses: actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af #@v1 - with: - profile: minimal - toolchain: stable - components: clippy - override: true - - - name: Install required cargo - run: cargo install clippy-sarif sarif-fmt - - - name: Run rust-clippy - run: - cargo clippy - --workspace - --all-features - --message-format=json | clippy-sarif | tee rust-clippy-results.sarif | sarif-fmt - continue-on-error: true - - - name: Upload analysis results to GitHub - uses: github/codeql-action/upload-sarif@v1 - with: - sarif_file: rust-clippy-results.sarif - wait-for-processing: true diff --git a/.github/workflows/rust-latest.yml b/.github/workflows/rust-latest.yml new file mode 100644 index 00000000..401451bc --- /dev/null +++ b/.github/workflows/rust-latest.yml @@ -0,0 +1,47 @@ +name: Latest stable toolchain +on: + push: + branches: [master] + schedule: + - cron: '37 10 * * 6' + workflow_dispatch: + +jobs: + latest-stable: + env: + RUST_LOG: debug + # Early warning for toolchain drift. The build job is pinned, so without this a new + # compiler or a new clippy lint would go unnoticed until someone bumped the pin by hand. + # It does not run on pull requests, so it can never block a merge. + name: Build and run tests on latest stable + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - name: Checkout submodules + run: git submodule update --init --recursive + - name: Update apt cache + run: sudo apt-get update + - name: Install system dependencies + run: sudo apt-get install libudev-dev libdbus-1-dev libsodium-dev libnfc-dev libpcsclite-dev publicsuffix + - name: Install latest stable toolchain + run: rustup toolchain install stable --profile minimal -c clippy,rustfmt && rustup default stable + - name: Clippy + run: cargo clippy --workspace --all-targets --all-features -- -D warnings + - name: Check formatting + run: cargo fmt --all -- --check + - name: Build + run: cargo build --workspace --all-targets --all-features + - name: Build with only nfc-backend-pcsc + run: cargo build -p libwebauthn --examples --features nfc-backend-pcsc + - name: Build with only nfc-backend-libnfc + run: cargo build -p libwebauthn --examples --features nfc-backend-libnfc + - name: Run tests + run: cargo test --workspace --verbose + env: + LIBWEBAUTHN_PSL_SYSTEM_TEST: "1" + - name: Run tests with nfc-backend-pcsc + run: cargo test -p libwebauthn --lib --features nfc-backend-pcsc --verbose + env: + LIBWEBAUTHN_PSL_SYSTEM_TEST: "1" + - name: Verify libwebauthn publishes cleanly + run: cargo publish --dry-run -p libwebauthn diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml index c20425f2..9c7c05b4 100644 --- a/.github/workflows/rust.yml +++ b/.github/workflows/rust.yml @@ -19,8 +19,8 @@ jobs: # Drop the toolchain the image ships with once we have switched off it. The job builds the # workspace three times over, and the runner does not have the disk to spare for both. run: | - rustup toolchain install 1.96.1 --profile minimal -c clippy,rustfmt - rustup default 1.96.1 + rustup toolchain install 1.97.0 --profile minimal -c clippy,rustfmt + rustup default 1.97.0 rustup toolchain uninstall stable - name: Clippy run: cargo clippy --workspace --all-targets --all-features -- -D warnings diff --git a/libwebauthn-tests/tests/basic_ctap1.rs b/libwebauthn-tests/tests/basic_ctap1.rs index aef493b9..a937cea0 100644 --- a/libwebauthn-tests/tests/basic_ctap1.rs +++ b/libwebauthn-tests/tests/basic_ctap1.rs @@ -21,7 +21,7 @@ async fn handle_updates(mut state_recv: Receiver) { async fn test_webauthn_basic_ctap1() { let mut device = get_virtual_device(); - println!("Selected HID authenticator: {}", &device); + println!("Selected HID authenticator: {}", device); let mut channel = device.channel(ChannelSettings::default()).await.unwrap(); channel.wink(TIMEOUT).await.unwrap(); diff --git a/libwebauthn-tests/tests/basic_ctap2.rs b/libwebauthn-tests/tests/basic_ctap2.rs index 9abaa878..71a56ff4 100644 --- a/libwebauthn-tests/tests/basic_ctap2.rs +++ b/libwebauthn-tests/tests/basic_ctap2.rs @@ -32,7 +32,7 @@ async fn test_webauthn_basic_ctap2() { let user_id: [u8; 32] = thread_rng().gen(); let challenge: [u8; 32] = thread_rng().gen(); - println!("Selected HID authenticator: {}", &device); + println!("Selected HID authenticator: {}", device); let mut channel = device.channel(ChannelSettings::default()).await.unwrap(); channel.wink(TIMEOUT).await.unwrap(); diff --git a/libwebauthn/examples/ceremony/u2f_nfc.rs b/libwebauthn/examples/ceremony/u2f_nfc.rs index 122169c4..4c80b10f 100644 --- a/libwebauthn/examples/ceremony/u2f_nfc.rs +++ b/libwebauthn/examples/ceremony/u2f_nfc.rs @@ -23,7 +23,7 @@ pub async fn main() -> Result<(), Box> { let device = get_nfc_device().await?; if let Some(mut device) = device { - println!("Selected NFC authenticator: {}", &device); + println!("Selected NFC authenticator: {}", device); let mut channel = device.channel(ChannelSettings::default()).await?; const APP_ID: &str = "https://foo.example.org"; diff --git a/libwebauthn/examples/ceremony/webauthn_ble.rs b/libwebauthn/examples/ceremony/webauthn_ble.rs index 981214ef..fcdecacf 100644 --- a/libwebauthn/examples/ceremony/webauthn_ble.rs +++ b/libwebauthn/examples/ceremony/webauthn_ble.rs @@ -20,7 +20,7 @@ pub async fn main() -> Result<(), Box> { println!("Devices found: {:?}", devices); for mut device in devices { - println!("Selected BLE authenticator: {}", &device); + println!("Selected BLE authenticator: {}", device); let mut channel = device.channel(ChannelSettings::default()).await?; let request_origin: RequestOrigin = diff --git a/libwebauthn/examples/ceremony/webauthn_hid.rs b/libwebauthn/examples/ceremony/webauthn_hid.rs index 6e7ec823..f16474f0 100644 --- a/libwebauthn/examples/ceremony/webauthn_hid.rs +++ b/libwebauthn/examples/ceremony/webauthn_hid.rs @@ -23,7 +23,7 @@ pub async fn main() -> Result<(), Box> { println!("Devices found: {:?}", devices); for mut device in devices { - println!("Selected HID authenticator: {}", &device); + println!("Selected HID authenticator: {}", device); let mut channel = device.channel(ChannelSettings::default()).await?; channel.wink(TIMEOUT).await?; diff --git a/libwebauthn/examples/features/prf_replay.rs b/libwebauthn/examples/features/prf_replay.rs index 2c4b9ae2..3e589ccf 100644 --- a/libwebauthn/examples/features/prf_replay.rs +++ b/libwebauthn/examples/features/prf_replay.rs @@ -50,7 +50,7 @@ pub async fn main() -> Result<(), Box> { let challenge: [u8; 32] = thread_rng().gen(); for mut device in devices { - println!("Selected HID authenticator: {}", &device); + println!("Selected HID authenticator: {}", device); let mut channel = device.channel(ChannelSettings::default()).await?; channel.wink(TIMEOUT).await?; diff --git a/libwebauthn/examples/features/webauthn_extensions_hid.rs b/libwebauthn/examples/features/webauthn_extensions_hid.rs index 418c2e8a..c5ae0245 100644 --- a/libwebauthn/examples/features/webauthn_extensions_hid.rs +++ b/libwebauthn/examples/features/webauthn_extensions_hid.rs @@ -47,7 +47,7 @@ pub async fn main() -> Result<(), Box> { }; for mut device in devices { - println!("Selected HID authenticator: {}", &device); + println!("Selected HID authenticator: {}", device); let mut channel = device.channel(ChannelSettings::default()).await?; channel.wink(TIMEOUT).await?; diff --git a/libwebauthn/examples/features/webauthn_prf_hid.rs b/libwebauthn/examples/features/webauthn_prf_hid.rs index 21477939..0e098f63 100644 --- a/libwebauthn/examples/features/webauthn_prf_hid.rs +++ b/libwebauthn/examples/features/webauthn_prf_hid.rs @@ -40,7 +40,7 @@ pub async fn main() -> Result<(), Box> { }; for mut device in devices { - println!("Selected HID authenticator: {}", &device); + println!("Selected HID authenticator: {}", device); let mut channel = device.channel(ChannelSettings::default()).await?; channel.wink(TIMEOUT).await?; diff --git a/libwebauthn/examples/features/webauthn_related_origins_hid.rs b/libwebauthn/examples/features/webauthn_related_origins_hid.rs index d83620f3..512ee970 100644 --- a/libwebauthn/examples/features/webauthn_related_origins_hid.rs +++ b/libwebauthn/examples/features/webauthn_related_origins_hid.rs @@ -32,7 +32,7 @@ pub async fn main() -> Result<(), Box> { println!("Devices found: {:?}", devices); for mut device in devices { - println!("Selected HID authenticator: {}", &device); + println!("Selected HID authenticator: {}", device); let mut channel = device.channel(ChannelSettings::default()).await?; channel.wink(TIMEOUT).await?; diff --git a/libwebauthn/examples/management/authenticator_config_hid.rs b/libwebauthn/examples/management/authenticator_config_hid.rs index aef087a5..b8719835 100644 --- a/libwebauthn/examples/management/authenticator_config_hid.rs +++ b/libwebauthn/examples/management/authenticator_config_hid.rs @@ -73,7 +73,7 @@ pub async fn main() -> Result<(), Box> { println!("Devices found: {:?}", devices); for mut device in devices { - println!("Selected HID authenticator: {}", &device); + println!("Selected HID authenticator: {}", device); let mut channel = device.channel(ChannelSettings::default()).await?; channel.wink(TIMEOUT).await?; diff --git a/libwebauthn/examples/management/cred_management_hid.rs b/libwebauthn/examples/management/cred_management_hid.rs index e16ef896..0d83a27a 100644 --- a/libwebauthn/examples/management/cred_management_hid.rs +++ b/libwebauthn/examples/management/cred_management_hid.rs @@ -85,7 +85,7 @@ pub async fn main() -> Result<(), WebAuthnError> { println!("Devices found: {:?}", devices); for mut device in devices { - println!("Selected HID authenticator: {}", &device); + println!("Selected HID authenticator: {}", device); let mut channel = device.channel(ChannelSettings::default()).await?; channel .wink(TIMEOUT) diff --git a/libwebauthn/examples/management/persistent_cred_management_hid.rs b/libwebauthn/examples/management/persistent_cred_management_hid.rs index 0e4e522f..3505721a 100644 --- a/libwebauthn/examples/management/persistent_cred_management_hid.rs +++ b/libwebauthn/examples/management/persistent_cred_management_hid.rs @@ -36,7 +36,7 @@ pub async fn main() -> Result<(), WebAuthnError> { println!("Devices found: {:?}", devices); for mut device in devices { - println!("Selected HID authenticator: {}", &device); + println!("Selected HID authenticator: {}", device); // Pass the store via ChannelSettings; the channel reuses or mints a persistent // token through it. The same settings apply to any transport. diff --git a/libwebauthn/src/transport/cable/known_devices.rs b/libwebauthn/src/transport/cable/known_devices.rs index 6a64706d..01d42cdc 100644 --- a/libwebauthn/src/transport/cable/known_devices.rs +++ b/libwebauthn/src/transport/cable/known_devices.rs @@ -139,7 +139,7 @@ impl Display for CableKnownDevice { write!( f, "{} ({})", - &self.device_info.name, + self.device_info.name, hex::encode(self.device_info.public_key) ) }