From efacef6ea95fb42123f1da392481ecfaf2c85d1b Mon Sep 17 00:00:00 2001
From: Martin Pluskal <martin@pluskal.org>
Date: Tue, 18 Aug 2026 15:36:21 +0200
Subject: [PATCH] ci: pin Swatinem/rust-cache to the v2.9.2 release commit

Every rust-cache pin this repo ever had was an untagged master commit -
the initial hand-written pin was already one commit past v2.9.1, and
Dependabot preserved the posture because its updater follows version
tags only while the pinned commit is itself tagged; untagged pins track
the containing branch head, self-perpetuating. Pinning 6323deb1, the
commit v2.9.2's annotated tag dereferences to, both makes the # comment
true and permanently flips Dependabot to release-following.

Deliberate 3-commit downgrade: drops upstream #377 (cache-cleanup
timestamp pruning fix), cache-efficiency only; release artifacts never
touch this action. Re-bump lands automatically when v2.9.3 ships.

Closes #102
---
 .github/dependabot.yml   | 13 +++++++++++++
 .github/workflows/ci.yml | 10 +++++-----
 2 files changed, 18 insertions(+), 5 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 9066cdb..98df6b2 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -17,6 +17,19 @@ updates:
 
   # GitHub Actions used by the workflows. Keeps the SHA-pinned actions in
   # ci.yml / release.yml current so they cannot silently rot.
+  #
+  # Pin every action to a commit a version tag points at, and name that
+  # release in the trailing `# vX.Y.Z` comment. This file cannot enforce it:
+  # the github-actions ecosystem has no "releases only" setting, and the
+  # property lives in the SHA in the workflow, not here. Dependabot follows
+  # version tags for a SHA pin only while the pinned commit is itself
+  # tagged; for an untagged SHA it falls back to the head of the branch
+  # containing that commit and keeps it there, so one bump onto an untagged
+  # commit converts a release pin into branch-tracking, and preserves it
+  # once there. Swatinem/rust-cache was pinned to an untagged commit from
+  # the start, so it never left branch-tracking (#102). A tagged pin
+  # re-arms release-following on its own; what catches a relapse is
+  # checking a bumped SHA against the `# vX.Y.Z` comment it claims.
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ac8fb38..f26d46e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -35,7 +35,7 @@ jobs:
         # Tag runs re-verify a release: keep them off restored build state;
         # PR/main runs keep the cache.
         if: ${{ !startsWith(github.ref, 'refs/tags/') }}
-        uses: Swatinem/rust-cache@258712b0b7b1ddf8bddc9fc3b0faca682b2736c3  # v2
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6  # v2.9.2
         with:
           workspaces: . -> target
       - name: Format
@@ -70,7 +70,7 @@ jobs:
         # Tag runs re-verify a release: keep them off restored build state;
         # PR/main runs keep the cache.
         if: ${{ !startsWith(github.ref, 'refs/tags/') }}
-        uses: Swatinem/rust-cache@258712b0b7b1ddf8bddc9fc3b0faca682b2736c3  # v2
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6  # v2.9.2
         with:
           workspaces: . -> target
       - name: Clippy
@@ -96,7 +96,7 @@ jobs:
           components: clippy
       - name: Cache cargo
         if: ${{ !startsWith(github.ref, 'refs/tags/') }}
-        uses: Swatinem/rust-cache@258712b0b7b1ddf8bddc9fc3b0faca682b2736c3  # v2
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6  # v2.9.2
         with:
           workspaces: . -> target
       - name: Clippy (beta)
@@ -137,7 +137,7 @@ jobs:
           toolchain: "1.88"
       - name: Cache cargo
         if: ${{ !startsWith(github.ref, 'refs/tags/') }}
-        uses: Swatinem/rust-cache@258712b0b7b1ddf8bddc9fc3b0faca682b2736c3  # v2
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6  # v2.9.2
         with:
           workspaces: . -> target
       - name: Build (MSRV)
@@ -159,7 +159,7 @@ jobs:
           toolchain: "1.97.1"
       - name: Cache cargo
         if: ${{ !startsWith(github.ref, 'refs/tags/') }}
-        uses: Swatinem/rust-cache@258712b0b7b1ddf8bddc9fc3b0faca682b2736c3  # v2
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6  # v2.9.2
         with:
           workspaces: . -> target
       - name: Regenerate man page + completions