code/cl8y-dex-terraclassic

Fork 0

CI: bump qa-indexer-binary to rust:1.85 for edition2024 deps #881

Merged

PlasticDigits merged 2 commits from fix/370-qa-indexer-binary-rust-185 into main

2026-06-12 08:31:53 +00:00

PlasticDigits commented

2026-06-12 08:14:10 +00:00

(Migrated from gitlab.com)

Summary

Bump qa-indexer-binary CI image from rust:1.83-bookworm to rust:1.85-bookworm.
Transitive dep base64ct 1.8.3 requires Cargo edition2024, stabilized in Rust 1.85; 1.83 fails at manifest parse before compile.

Verification checklist (#370)

Acceptance item	Command / result	Status
Reproduce CI failure on 1.83	`docker run --rm -v $PWD/indexer:/app -w /app rust:1.83-bookworm bash -c 'apt-get update -qq && apt-get install -y -qq libssl-dev pkg-config && cargo build --release'` → `feature edition2024 is required` on `base64ct-1.8.3`	PASS
Indexer release build on 1.85	Same command with `rust:1.85-bookworm` → `Finished release profile`	PASS
No further edition2024 cascade	Full `cargo build --release` on 1.85 completed without manifest parse errors	PASS
Release binary produced	`indexer/target/release/cl8y-dex-indexer` exists and is executable (~30 MB)	PASS
CI config updated	`.gitlab-ci.yml` `qa-indexer-binary.image` → `rust:1.85-bookworm`	PASS
`qa-indexer-binary` job green + artifact upload	Pending pipeline on this MR	PENDING

Follow-ups

Consider aligning CI Rust pin with AGENTS.md / cloud-agent toolchain (1.96+) in a separate change if we want parity with local dev.

Note

Low Risk
CI-only Docker image pin; no runtime or application logic changes.

Overview
Fixes qa-indexer-binary failing before compile when transitive base64ct 1.8.3 requires Cargo edition2024, which rust:1.83-bookworm cannot parse.

The job’s Docker image is raised to Rust ≥ 1.85 (minimum for edition 2024); the repo comment also ties this to AGENTS.md / local 1.96+ toolchain parity. cargo build --release in indexer/ and QA artifact upload behavior are unchanged—only the CI compiler baseline moves.

^{Reviewed by Cursor Bugbot for commit 47301c81b9. Bugbot is set up for automated code reviews on this repo. Configure here.}

## Summary - Bump `qa-indexer-binary` CI image from `rust:1.83-bookworm` to `rust:1.85-bookworm`. - Transitive dep `base64ct` 1.8.3 requires Cargo `edition2024`, stabilized in Rust 1.85; 1.83 fails at manifest parse before compile. ## Verification checklist (#370) | Acceptance item | Command / result | Status | |-----------------|------------------|--------| | Reproduce CI failure on 1.83 | `docker run --rm -v $PWD/indexer:/app -w /app rust:1.83-bookworm bash -c 'apt-get update -qq && apt-get install -y -qq libssl-dev pkg-config && cargo build --release'` → `feature edition2024 is required` on `base64ct-1.8.3` | PASS | | Indexer release build on 1.85 | Same command with `rust:1.85-bookworm` → `Finished release profile` | PASS | | No further edition2024 cascade | Full `cargo build --release` on 1.85 completed without manifest parse errors | PASS | | Release binary produced | `indexer/target/release/cl8y-dex-indexer` exists and is executable (~30 MB) | PASS | | CI config updated | `.gitlab-ci.yml` `qa-indexer-binary.image` → `rust:1.85-bookworm` | PASS | | `qa-indexer-binary` job green + artifact upload | Pending pipeline on this MR | PENDING | ## Follow-ups - Consider aligning CI Rust pin with AGENTS.md / cloud-agent toolchain (1.96+) in a separate change if we want parity with local dev.  --- > [!NOTE] > **Low Risk** > CI-only Docker image pin; no runtime or application logic changes. > > **Overview** > Fixes **`qa-indexer-binary`** failing before compile when transitive **`base64ct` 1.8.3** requires Cargo **`edition2024`**, which **`rust:1.83-bookworm`** cannot parse. > > The job’s Docker image is raised to **Rust ≥ 1.85** (minimum for edition 2024); the repo comment also ties this to **AGENTS.md / local 1.96+** toolchain parity. **`cargo build --release`** in `indexer/` and QA artifact upload behavior are unchanged—only the CI compiler baseline moves. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 47301c81b945772939751e28d0957b3b350cadd9. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>

ghost1 commented

2026-06-12 08:14:17 +00:00

(Migrated from gitlab.com)

changed the description

ghost1 commented

2026-06-12 08:14:22 +00:00

(Migrated from gitlab.com)

changed the description

PlasticDigits commented

2026-06-12 08:15:47 +00:00

(Migrated from gitlab.com)

Security review

Commit reviewed: f911b8d0ab2f3484936814399a5d6ab8a4b2818e
Scope: .gitlab-ci.yml — qa-indexer-binary Docker image rust:1.83-bookworm → rust:1.85-bookworm (1 line).

Outcome: FINDINGS: 0 medium+

Summary

Security review: no medium+ findings on this diff.

Reviewed attack surfaces

Area	Result
Injection (shell, SQL, path)	N/A — image tag change only; job script unchanged
Authn / authz	Unchanged — same branch/web pipeline rules and `CI_JOB_TOKEN` package upload
Secret leakage / logging	Unchanged
SSRF / XSS / deserialization	No runtime surface touched
Supply chain	Uses the same official `rust:*-bookworm` floating-tag pattern as before; version bump is required for build correctness, not a new trust boundary

Prior threads

No prior security-review inline comments on this MR; nothing to re-report.

Inline threads: none (no findings).

## Security review **Commit reviewed:** `f911b8d0ab2f3484936814399a5d6ab8a4b2818e` **Scope:** `.gitlab-ci.yml` — `qa-indexer-binary` Docker image `rust:1.83-bookworm` → `rust:1.85-bookworm` (1 line). **Outcome:** `FINDINGS: 0` medium+ ### Summary Security review: **no medium+ findings** on this diff. This MR changes only the CI build image for the `qa-indexer-binary` job so `cargo build --release` can parse transitive manifests requiring `edition2024` (e.g. `base64ct` 1.8.3). No application, contract, indexer, or frontend runtime code is modified. ### Reviewed attack surfaces | Area | Result | |------|--------| | Injection (shell, SQL, path) | N/A — image tag change only; job script unchanged | | Authn / authz | Unchanged — same branch/web pipeline rules and `CI_JOB_TOKEN` package upload | | Secret leakage / logging | Unchanged | | SSRF / XSS / deserialization | No runtime surface touched | | Supply chain | Uses the same official `rust:*-bookworm` floating-tag pattern as before; version bump is required for build correctness, not a new trust boundary | ### Prior threads No prior security-review inline comments on this MR; nothing to re-report. **Inline threads:** none (no findings).

PlasticDigits commented

2026-06-12 08:31:34 +00:00

(Migrated from gitlab.com)

added 32 commits

f911b8d0...62050542 - 31 commits from branch main
47301c81 - Merge branch 'main' into fix/370-qa-indexer-binary-rust-185

Compare with previous version

added 32 commits <ul><li>f911b8d0...62050542 - 31 commits from branch <code>main</code></li><li>47301c81 - Merge branch 'main' into fix/370-qa-indexer-binary-rust-185</li></ul> [Compare with previous version](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/163/diffs?diff_id=1848540177&start_sha=f911b8d0ab2f3484936814399a5d6ab8a4b2818e)

PlasticDigits commented

2026-06-12 08:31:38 +00:00

(Migrated from gitlab.com)

Resolved merge conflict in .gitlab-ci.yml by merging main into this branch.

Conflict: qa-indexer-binary.image — this branch had rust:1.85-bookworm; main already bumped to rust:1.96-bookworm with a comment noting edition2024 / AGENTS.md alignment.

Resolution: Kept main's rust:1.96-bookworm pin (supersedes 1.85 and still fixes the base64ct edition2024 manifest parse failure).

Resolved merge conflict in `.gitlab-ci.yml` by merging `main` into this branch. **Conflict:** `qa-indexer-binary.image` — this branch had `rust:1.85-bookworm`; `main` already bumped to `rust:1.96-bookworm` with a comment noting edition2024 / AGENTS.md alignment. **Resolution:** Kept `main`'s `rust:1.96-bookworm` pin (supersedes 1.85 and still fixes the `base64ct` edition2024 manifest parse failure).

ghost1 commented

2026-06-12 08:31:50 +00:00

(Migrated from gitlab.com)

changed the description

PlasticDigits commented

2026-06-12 08:31:54 +00:00

(Migrated from gitlab.com)

mentioned in commit 77404b3da5

mentioned in commit 77404b3da59162172ee9d2418acab4d8861c790b

PlasticDigits (Migrated from gitlab.com) merged commit 77404b3da5 into main

2026-06-12 08:31:54 +00:00

PlasticDigits commented

2026-06-12 08:33:15 +00:00

(Migrated from gitlab.com)

Security review

Commit reviewed: 47301c81b945772939751e28d0957b3b350cadd9 (MR head; merge commit 77404b3da59162172ee9d2418acab4d8861c790b)
Scope: .gitlab-ci.yml — qa-indexer-binary Docker image bump (rust:1.83-bookworm → rust:1.85-bookworm in f911b8d0; merge resolution kept main's rust:1.96-bookworm pin with edition2024 comment).

Outcome: FINDINGS: 0 medium+

Summary

Security review: no medium+ findings on this diff.

This MR changes only the CI build image for the qa-indexer-binary job so cargo build --release can parse transitive manifests requiring edition2024 (e.g. base64ct 1.8.3). No application, contract, indexer, or frontend runtime code is modified. Job rules, script, before_script, artifact paths, and publish-qa-ci-artifacts.sh upload logic are unchanged.

Reviewed attack surfaces

Area	Result
Injection (shell, SQL, path)	N/A — image tag / comment change only; job script unchanged
Authn / authz	Unchanged — same branch/web pipeline rules and `CI_JOB_TOKEN` package upload
Secret leakage / logging	Unchanged
SSRF / XSS / deserialization	No runtime surface touched
Supply chain	Same official `rust:*-bookworm` floating-tag pattern as before; version raise is build-correctness, not a new trust boundary or dependency addition

Prior threads

Prior security review on f911b8d0 (FINDINGS: 0) still applies after merge-to-main resolution to rust:1.96-bookworm. No prior inline security findings to re-report.

Inline threads: none (no findings).

## Security review **Commit reviewed:** `47301c81b945772939751e28d0957b3b350cadd9` (MR head; merge commit `77404b3da59162172ee9d2418acab4d8861c790b`) **Scope:** `.gitlab-ci.yml` — `qa-indexer-binary` Docker image bump (`rust:1.83-bookworm` → `rust:1.85-bookworm` in `f911b8d0`; merge resolution kept `main`'s `rust:1.96-bookworm` pin with edition2024 comment). **Outcome:** `FINDINGS: 0` medium+ ### Summary Security review: **no medium+ findings** on this diff. This MR changes only the CI build image for the `qa-indexer-binary` job so `cargo build --release` can parse transitive manifests requiring `edition2024` (e.g. `base64ct` 1.8.3). No application, contract, indexer, or frontend runtime code is modified. Job `rules`, `script`, `before_script`, artifact paths, and `publish-qa-ci-artifacts.sh` upload logic are unchanged. ### Reviewed attack surfaces | Area | Result | |------|--------| | Injection (shell, SQL, path) | N/A — image tag / comment change only; job script unchanged | | Authn / authz | Unchanged — same branch/web pipeline rules and `CI_JOB_TOKEN` package upload | | Secret leakage / logging | Unchanged | | SSRF / XSS / deserialization | No runtime surface touched | | Supply chain | Same official `rust:*-bookworm` floating-tag pattern as before; version raise is build-correctness, not a new trust boundary or dependency addition | ### Prior threads Prior security review on `f911b8d0` (`FINDINGS: 0`) still applies after merge-to-`main` resolution to `rust:1.96-bookworm`. No prior inline security findings to re-report. **Inline threads:** none (no findings).