chore(deps): bump the github-actions group with 6 updates - #2
Closed
dependabot[bot] wants to merge 11 commits into
Closed
dependabot[bot] wants to merge 11 commits into
dependabot[bot] wants to merge 11 commits into
Conversation
10-crate workspace implementing the Indexarr read/write API, torrent name parser, content classifier, quality scoring, TMDB client, and identity management. Phase 1 (foundation): indexarr-core (config, models, DB schema, errors), indexarr-identity (Ed25519 keypair, contributor ID, ban list), indexarr-search (PostgreSQL FTS + 16 faceted filters), indexarr-web (Axum HTTP server, Torznab XML API, SPA serving), main.rs (CLI, worker orchestration, signal handling). Phase 2 (content pipeline + write APIs): indexarr-parser (regex-based torrent name parsing — resolution, codec, source, HDR, audio, episodes), indexarr-classifier (content type detection, quality scoring), indexarr-tmdb (TMDB API with rate limiter and circuit breaker), write endpoints (magnet upload, comments, votes, nuke moderation, tag CRUD, bulk import/delete, identity, system admin). 5,872 lines of Rust, 10 passing tests, ~35 API endpoints. Stub crates for Phase 3+ (DHT, announcer, sync).
Add indexarr-dht crate with: - DhtEngine: manages N librtbit-dht instances spread across 160-bit keyspace with adaptive crawling (random get_peers queries) - DhtSharedState: thread-safe hash queue + peer cache (DashMap, 200k max entries with LRU eviction) - Hash ingest worker: batches discovered hashes to PostgreSQL (500/batch, 5s flush interval, source priority: announce > get_peers > sample) - MetadataResolver: semaphore-bounded concurrent resolution, prioritized batch selection (priority > source quality > observations > recency), content pipeline integration (parser + classifier + quality scoring) - BEP 9 metadata fetch scaffolded (requires TCP peer connection wiring via librtbit-peer-protocol — noted as TODO) Wire dht_crawler and resolver workers into main.rs with proper lifecycle management (shared Arc<DhtEngine>, CancellationToken). ~880 new lines of Rust in indexarr-dht.
Phase 4 — indexarr-announcer (~320 lines): - Rolling pool announcer with HTTP tracker scrape for seed/peer counts - 3-strike rule (no_peers after 3 zero-activity scrapes) - Settle/rotate intervals, pool backfill from DB - Bencode scrape response parser Phase 5 — indexarr-sync (~1360 lines): - SyncManager: 3-loop gossip orchestrator (export, discovery, gossip) running concurrently via tokio::select! - DeltaExporter: incremental gzip NDJSON deltas with Ed25519 signing, SHA-256 content hashing, manifest generation, sequence tracking - DeltaMerger: 3-tier merge (insert/update/fill-gaps) with signature verification, epoch checking, ban enforcement, DoS limits - PeerTable: reputation tracking, tiered eviction, PEX discovery, longevity bonus, health tracking, DB persistence - Epoch system: signed declarations, data purge (seed vs non-seed), seed-only mode, filesystem cleanup All 5 workers now implemented: http_server, dht_crawler, resolver, announcer, sync. Total: ~8,500 lines of Rust, 10 passing tests.
- Multi-stage Dockerfile: Node 22 (Vue build) → Rust 1.86 (release binary) → Debian slim runtime (~13MB binary, ~30MB image) - docker-compose.yml: all workers + PostgreSQL 17 - docker-compose.sync.yml: sync-only mode (no DHT crawling) - GitHub Actions CI: cargo check, clippy, test, release build - GitHub Actions Docker: build + push to GHCR on main/tags - CLAUDE.md: project documentation for the Rust workspace - rust-toolchain.toml: pin stable channel All 6 phases of the Python→Rust migration complete. 8,512 lines of Rust, 10 crates, 10 tests, 13MB release binary.
Copy ui/ directory and classifier.yml from Python repo. These are needed by the multi-stage Dockerfile (Stage 1 builds Vue SPA).
CI and Docker builds need access to private AusAgentSmith-org repos (librtbit-dht, librtbit-core, etc.) via git+https. Configure git url.insteadOf with GH_PAT secret, set CARGO_NET_GIT_FETCH_WITH_CLI. Requires GH_PAT repo secret (set via gh secret set).
Bumps the github-actions group with 6 updates: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `4` | `6` | | [actions/cache](https://github.com/actions/cache) | `4` | `5` | | [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `3` | `4` | | [docker/login-action](https://github.com/docker/login-action) | `3` | `4` | | [docker/metadata-action](https://github.com/docker/metadata-action) | `5` | `6` | | [docker/build-push-action](https://github.com/docker/build-push-action) | `6` | `7` | Updates `actions/checkout` from 4 to 6 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v4...v6) Updates `actions/cache` from 4 to 5 - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](actions/cache@v4...v5) Updates `docker/setup-buildx-action` from 3 to 4 - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](docker/setup-buildx-action@v3...v4) Updates `docker/login-action` from 3 to 4 - [Release notes](https://github.com/docker/login-action/releases) - [Commits](docker/login-action@v3...v4) Updates `docker/metadata-action` from 5 to 6 - [Release notes](https://github.com/docker/metadata-action/releases) - [Commits](docker/metadata-action@v5...v6) Updates `docker/build-push-action` from 6 to 7 - [Release notes](https://github.com/docker/build-push-action/releases) - [Commits](docker/build-push-action@v6...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/cache dependency-version: '5' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: docker/setup-buildx-action dependency-version: '4' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: docker/login-action dependency-version: '4' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: docker/metadata-action dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: docker/build-push-action dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Author
|
This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests. To ignore these dependencies, configure ignore rules in dependabot.yml |
dependabot
Bot
deleted the
dependabot/github_actions/github-actions-79081331c3
branch
April 14, 2026 10:26
AusAgentSmith
added a commit
that referenced
this pull request
Apr 25, 2026
Adds a "Phase A audit findings" section capturing the actual state of the librtbit-* family after the line-by-line audit: - Corrected version inventory: family was reset to 0.1.x (original draft said 5.x/4.x/3.x), license is uniformly MIT (answers open-decision #2), hygiene flags for tracker-comms and lsd already resolved. - BEP parity table now reflects line:file citations on both sides. BEP 51 confirmed absent in librtbit-dht; BEP 28 confirmed absent in both stacks; BEP 11/15 confirmed rust-ahead. Bonus: BEP 55 (ut_holepunch) already in librtbit-peer-protocol. - Critical API gap not in original draft: librtbit-dht has no infohash- ingest callback. Today's indexarr-rs crawl is a random-target get_peers() workaround. BEP 51 + a passive-observation hook should ride together as librtbit-dht 0.2.0. - Locked target API for first crates.io publish per crate. - Open decisions list updated: license/btpydht-LOC/namespace resolved by audit; B1-vs-B2, tracker-comms glob fix, librtbit-dht 0.2.0 grouping still pending. Also includes a post-audit correction noting that all 12 librtbit-* crates are on the Forgejo cargo registry (the unauthenticated curl probes during Phase A returned empty bodies and were misread as 404s). Only the bottom 6 remain unpublished to crates.io.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the github-actions group with 6 updates:
464534345667Updates
actions/checkoutfrom 4 to 6Release notes
Sourced from actions/checkout's releases.
... (truncated)
Changelog
Sourced from actions/checkout's changelog.
... (truncated)
Commits
de0fac2Fix tag handling: preserve annotations and explicit fetch-tags (#2356)064fe7fAdd orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set (...8e8c483Clarify v6 README (#2328)033fa0dAdd worktree support for persist-credentials includeIf (#2327)c2d88d3Update all references from v5 and v4 to v6 (#2314)1af3b93update readme/changelog for v6 (#2311)71cf226v6-beta (#2298)069c695Persist creds to a separate file (#2286)ff7abcdUpdate README to include Node.js 24 support details and requirements (#2248)08c6903Prepare v5.0.0 release (#2238)Updates
actions/cachefrom 4 to 5Release notes
Sourced from actions/cache's releases.
... (truncated)
Changelog
Sourced from actions/cache's changelog.
... (truncated)
Commits
6682284Merge pull request #1738 from actions/prepare-v5.0.4e340396Update RELEASES8a67110Add licenses1865903Update dependencies & patch security vulnerabilities5656298Merge pull request #1722 from RyPeck/patch-14e380d1Fix cache key in examples.md for bun.lockb7e8d49Merge pull request #1701 from actions/Link-/fix-proxy-integration-tests984a21bAdd traffic sanity check stepacf2f1fFix resolution95a07c5Add wait for proxyUpdates
docker/setup-buildx-actionfrom 3 to 4Release notes
Sourced from docker/setup-buildx-action's releases.
... (truncated)
Commits
4d04d5dMerge pull request #485 from docker/dependabot/npm_and_yarn/docker/actions-to...cd74e05chore: update generated contenteee38ecbuild(deps): bump@docker/actions-toolkitfrom 0.77.0 to 0.79.07a83f65Merge pull request #484 from docker/dependabot/github_actions/docker/setup-qe...a5aa967Merge pull request #464 from crazy-max/rm-deprecatede73d53fbuild(deps): bump docker/setup-qemu-action from 3 to 428a438eMerge pull request #483 from crazy-max/node24034e9d3chore: update generated contentb4664d8remove deprecated inputs/outputsa8257denode 24 as default runtimeUpdates
docker/login-actionfrom 3 to 4Release notes
Sourced from docker/login-action's releases.
... (truncated)
Commits
4907a6dMerge pull request #930 from docker/dependabot/npm_and_yarn/aws-sdk-dependenc...1e233e6chore: update generated content6c24eadbuild(deps): bump the aws-sdk-dependencies group with 2 updatesee034d7Merge pull request #958 from docker/dependabot/npm_and_yarn/lodash-4.18.11527209Merge pull request #937 from docker/dependabot/npm_and_yarn/proxy-agent-depen...d39362abuild(deps): bump lodash from 4.17.23 to 4.18.1a6f092bchore: update generated content60953f0build(deps): bump the proxy-agent-dependencies group with 2 updates62c6885Merge pull request #936 from docker/dependabot/npm_and_yarn/docker/actions-to...102c0e6chore: update generated contentUpdates
docker/metadata-actionfrom 5 to 6Release notes
Sourced from docker/metadata-action's releases.
... (truncated)
Commits
030e881Merge pull request #607 from crazy-max/allow-comments4b529acchore: update generated contentb0082b3preserve comments in list input values with commentNoInfix7b19fecMerge pull request #604 from docker/dependabot/npm_and_yarn/docker/actions-to...281c9b0chore: update generated content5f43b3btest: stabilize github mock setup since ESM9d53276github class moved since actions-toolkit v0.77.0eaa3d39chore(deps): Bump@docker/actions-toolkitfrom 0.68.0 to 0.77.06b695f7Merge pull request #605 from crazy-max/node24a1afadcnode 24 as default runtimeUpdates
docker/build-push-actionfrom 6 to 7Release notes
Sourced from docker/build-push-action's releases.
... (truncated)
Commits
d08e5c3Merge pull request #1479 from docker/dependabot/npm_and_yarn/docker/actions-t...cbd2dffchore: update generated contentf76f51fchore(deps): Bump@docker/actions-toolkitfrom 0.78.0 to 0.79.07d03e66Merge pull request #1473 from crazy-max/rm-deprecated-envs98f853dchore: update generated contentcadccf6remove deprecated envs03fe877Merge pull request #1478 from docker/dependabot/github_actions/docker/setup-b...827e366chore(deps): Bump docker/setup-buildx-action from 3 to 4e25db87Merge pull request #1474 from crazy-max/rm-export-build-tool1ac2573Merge pull request #1470 from crazy-max/node24Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions