ci: pin actions, refresh dependencies, and improve Dependabot config by wmmc88 · Pull Request #68 · microsoft/Windows-rust-driver-samples

Melvin Wang (wmmc88) · 2026-10-28T15:09:48Z

Picks up Dan Fiedler (@danfiedler-msft)'s action pinning from #66 and brings it in line with the follow-up work done in microsoft/windows-drivers-rs#745.

Actions are refreshed to their latest releases, and the dtolnay/rust-toolchain steps that used @stable/@nightly now pass toolchain explicitly since a SHA pin no longer carries the toolchain in the ref. Dependabot now groups Cargo updates per dependency and batches minor/patch action bumps, with staggered weekly runs to match windows-drivers-rs.

Also does a one-time Cargo refresh. windows-sys 0.61 moved BOOL to windows_sys::core, so echoapp needed a one-line import fix. Serde, clap, thiserror and prettyplease stay on their latest Syn 2 releases to avoid duplicate syn versions.

Supersedes #66.

Replace the windows-drivers-rs main-branch patches with the latest crates.io releases and update the cargo-make loader to wdk-build 0.6.0. Refresh Cargo.lock while retaining bindgen's compatible Syn 2 resolution.

serde_derive 1.0.229 moved to syn 3 while bindgen, wdk-macros and clap_derive are still on syn 2, which trips clippy's multiple_crate_versions lint.

Cargo's build-dir layout v2 nests rust-script's long package name twice, pushing the cargo-make load_script binary past MAX_PATH. Point build-dir at a short path via a rust-script-scoped cargo config so driver builds, which rely on OUT_DIR being under the workspace, are unaffected.

@nightly

Bump the pinned actions to their latest releases: checkout v7.0.1, dependency-review-action v5.0.0, audit-check v2.0.0, and the latest dtolnay/rust-toolchain v1 commit. A SHA-pinned dtolnay/rust-toolchain no longer derives the toolchain from its ref name, so the former @stable and @nightly steps now pass toolchain explicitly.

Mirror the windows-drivers-rs Dependabot configuration. Cargo updates are grouped per dependency name, and minor and patch GitHub Actions updates are batched into one PR while major upgrades stay separate. Cargo updates run Tuesdays and Actions updates run Thursdays, both at 23:00 UTC, 12 hours apart from the daily 11:00 UTC CI runs.

Raise the anyhow, paste, once_cell, uuid, and windows-sys requirements to their latest releases and refresh the lockfile. windows-sys 0.61 moves BOOL to windows_sys::core, so echoapp imports it from there. Syn stays at 2.0.119 for everything built on Windows; bindgen's prettyplease, clap, serde, and thiserror remain at their latest Syn 2 releases, matching windows-drivers-rs. Syn 3 only appears in the lockfile through uuid's wasm32-only wasm-bindgen dependency.

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Copilot

🟡 Changes recommended

Unresolved critical findings leave CI dependent on mutable external action code, and the uuid upgrade conflicts with the package’s declared Rust 1.72.1 MSRV.

4 open issues

_{Review effort: Lite (auto)}

unicode-ident 1.0.27 is licensed as (MIT OR Apache-2.0) AND Unicode-3.0, which dependency-review-action can't evaluate (actions/dependency-review-action#263). Add a versioned exception, matching windows-drivers-rs.

Copilot

🔵 Needs a closer look

Critical mutable repository references remain in three workflows, and the dependency-review allow-list targets the wrong anstyle version, leaving active correctness and supply-chain issues unresolved.

4 open issues

1 previously missed issue

In code that hasn't changed since last review

Update anstyle allow-list entry to the resolved version

.github/workflows/github-dependency-review.yaml:36

The new allow-list entry still names anstyle@1.0.4, but this lockfile now resolves anstyle to 1.0.14 (and the previous lockfile already showed 1.0.13). Because this input uses an exact package URL, the exception will not match the dependency-review result and the workflow can continue to reject the anstyle license. Update both the explanatory version and the package URL to the version actually present in the lockfile.

_{Review effort: Lite (auto)}

dependency-review-action now evaluates AND expressions (actions/dependency-review-action#263 is fixed). unicode-ident 1.0.27 failed only because Unicode-3.0, the successor to Unicode-DFS-2016, was missing from the allowlist.

Copilot

🔵 Needs a closer look

A critical build configuration issue causes the cargo make packaging step to panic before loading the driver makefiles because the relocated OUT_DIR prevents wdk-build from finding Cargo.lock.

4 open issues

1 previously missed issue

In code that hasn't changed since last review

Keep wdk-build OUT_DIR within the rust-script project tree

.github/workflows/build.yaml:121

This Cargo config is inherited by the cargo process that rust-script starts, so it also moves wdk-build's OUT_DIR under $RUNNER_TEMP/rsb. In wdk-build 0.6.0, the build script locates Cargo.lock by walking the ancestors of OUT_DIR; because this directory is outside the rust-script project, that lookup fails and the cargo make packaging step panics before loading the driver makefiles. The short build directory needs to be kept within the rust-script project tree or the wdk-build lookup needs a different arrangement.

_{Review effort: Lite (auto)}

The exception only matched anstyle 1.0.4, which hasn't been in Cargo.lock for a long time. GitHub reports anstyle 1.0.14 as MIT OR Apache-2.0, so no override is needed.

Copilot

🔵 Needs a closer look

Validation must be deferred because the WDK/toolchain, Windows CI, kernel-driver dependency, and rust-script path changes require unavailable EWDK/Windows runners to verify.

1 open issue

Resolve uuid MSRV conflict with package Rust version

3 resolved since last review

_{Review effort: Lite (auto)}

Copilot

🔵 Needs a closer look

The package’s declared Rust 1.72.1 MSRV conflicts with the uuid 1.29.0 dependency requiring Rust 1.89.0, leaving an active compatibility issue that must be resolved.

1 open issue

Resolve uuid MSRV conflict with package Rust version

_{Review effort: Lite (auto)}

The 1.72.1 MSRV was stale (uuid 1.29 already requires 1.89, and the WDR crates require 1.91) and nothing in CI checked it. As samples, these crates track the toolchain WDR supports rather than declaring their own. Without the old MSRV, clippy applies its newer lints, so use &raw pointers instead of implicit reference coercions and switch to std::sync::LazyLock, which removes the once_cell dependency.

Match the drivers and windows-drivers-rs by keeping every dependency version in [workspace.dependencies]; echoapp keeps only its feature selections.

Copilot

🔵 Needs a closer look

The combined WDK/toolchain refresh and Windows-specific build-path workaround require EWDK/Windows CI validation to verify cargo-make loading, path behavior, and driver packaging, which is unavailable here.

No open issues 🎉

1 resolved since last review

Resolve uuid MSRV conflict with package Rust version

_{Review effort: Lite (auto)}

…ndabot-refresh # Conflicts: # Cargo.lock # Cargo.toml

Copilot

🔵 Needs a closer look

Human validation is warranted because the broad dependency and CI refresh changes the Windows FFI and toolchain surface, while the Windows/WDK matrix and dependency-review checks cannot be exercised here.

No open issues 🎉

_{Review effort: Lite (auto)}

Melvin Wang (wmmc88) and others added 11 commits October 22, 2026 14:32

chore: update to oct 2026 windows-drivers-rs release

c89520a

chore(deps): use published October 2026 WDR crates

cd35006

Replace the windows-drivers-rs main-branch patches with the latest crates.io releases and update the cargo-make loader to wdk-build 0.6.0. Refresh Cargo.lock while retaining bindgen's compatible Syn 2 resolution.

chore(deps): restore default WDR features

cda61a3

style: apply latest nightly rustfmt comment wrapping

a291b33

fix(deps): pin serde to 1.0.228 to avoid duplicate syn versions

6ad5047

serde_derive 1.0.229 moved to syn 3 while bindgen, wdk-macros and clap_derive are still on syn 2, which trips clippy's multiple_crate_versions lint.

ci: clarify LNK1104 path length comment

d2d9644

Pin GitHub Actions to full-length commit SHAs

1714235

Copilot AI auto review requested due to automatic review settings October 28, 2026 15:09

Copilot started reviewing on behalf of Melvin Wang (wmmc88) October 28, 2026 15:10

View session

Copilot AI reviewed Oct 28, 2026

Melvin Wang (wmmc88) mentioned this pull request Oct 28, 2026

Pin GitHub Actions to full-length commit SHAs #66

Closed

Melvin Wang (wmmc88) marked this pull request as draft October 28, 2026 15:20

Melvin Wang (wmmc88) requested an auto review from Copilot October 28, 2026 15:20

Copilot started reviewing on behalf of Melvin Wang (wmmc88) October 28, 2026 15:21

View session

Copilot AI reviewed Oct 28, 2026

View reviewed changes

Comment thread .github/workflows/build.yaml Resolved

Comment thread .github/workflows/docs.yaml Resolved

Comment thread .github/workflows/lint.yaml Resolved

Comment thread general/echo/kmdf/exe/Cargo.toml Resolved

ci: allow unicode-ident AND license in dependency review

7708f99

unicode-ident 1.0.27 is licensed as (MIT OR Apache-2.0) AND Unicode-3.0, which dependency-review-action can't evaluate (actions/dependency-review-action#263). Add a versioned exception, matching windows-drivers-rs.

Copilot AI auto review requested due to automatic review settings October 28, 2026 22:57

Copilot started reviewing on behalf of Melvin Wang (wmmc88) October 28, 2026 22:58

View session

Copilot AI reviewed Oct 28, 2026

View reviewed changes

Copilot AI auto review requested due to automatic review settings October 28, 2026 23:44

Copilot started reviewing on behalf of Melvin Wang (wmmc88) October 28, 2026 23:45

View session

Copilot AI reviewed Oct 28, 2026

View reviewed changes

ci: drop stale anstyle license exception

fa368ba

The exception only matched anstyle 1.0.4, which hasn't been in Cargo.lock for a long time. GitHub reports anstyle 1.0.14 as MIT OR Apache-2.0, so no override is needed.

Copilot AI auto review requested due to automatic review settings November 2, 2026 19:31

Copilot started reviewing on behalf of Melvin Wang (wmmc88) November 2, 2026 19:32

View session

chore: add trailing newline to dependabot.yaml

47a605c

Copilot AI reviewed Nov 2, 2026

View reviewed changes

Copilot AI auto review requested due to automatic review settings November 2, 2026 19:37

Copilot started reviewing on behalf of Melvin Wang (wmmc88) November 2, 2026 19:37

View session

Copilot AI reviewed Nov 2, 2026

View reviewed changes

Melvin Wang (wmmc88) added 2 commits November 2, 2026 12:01

build: declare echoapp dependencies in the workspace root

6fd38c9

Match the drivers and windows-drivers-rs by keeping every dependency version in [workspace.dependencies]; echoapp keeps only its feature selections.

Copilot AI auto review requested due to automatic review settings November 2, 2026 20:03

Copilot started reviewing on behalf of Melvin Wang (wmmc88) November 2, 2026 20:03

View session

Copilot AI reviewed Nov 2, 2026

View reviewed changes

Merge remote-tracking branch 'upstream/main' into ci/pin-actions-depe…

a80a974

…ndabot-refresh # Conflicts: # Cargo.lock # Cargo.toml

Melvin Wang (wmmc88) marked this pull request as ready for review November 3, 2026 02:45

Copilot AI auto review requested due to automatic review settings November 3, 2026 02:45

Copilot started reviewing on behalf of Melvin Wang (wmmc88) November 3, 2026 02:46

View session

Copilot AI reviewed Nov 3, 2026

View reviewed changes

Melvin Wang (wmmc88) commented Nov 3, 2026

View reviewed changes

Comment thread general/echo/kmdf/exe/Cargo.toml Resolved

Melvin Wang (wmmc88) commented Nov 3, 2026

View reviewed changes

Comment thread general/echo/kmdf/exe/Cargo.toml Resolved

Melvin Wang (wmmc88) enabled auto-merge (squash) November 3, 2026 03:13

Melvin Wang (wmmc88) requested a review from a team November 3, 2026 06:34

Alan632 approved these changes Nov 3, 2026

View reviewed changes

Shravan Vasista (svasista-ms) approved these changes Nov 4, 2026

View reviewed changes

Melvin Wang (wmmc88) merged commit 0badf91 into microsoft:main Nov 4, 2026
150 checks passed

Navigation Menu

Repository navigation

ci: pin actions, refresh dependencies, and improve Dependabot config - #68

ci: pin actions, refresh dependencies, and improve Dependabot config#68
Melvin Wang (wmmc88) merged 18 commits into
microsoft:mainfrom
wmmc88:ci/pin-actions-dependabot-refresh

Melvin Wang (wmmc88) commented Oct 28, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

Melvin Wang (wmmc88) commented Oct 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Melvin Wang (wmmc88) commented Oct 28, 2026 •

edited

Loading