[MotherSphere]

CI

• dtolnay/rust-toolchain is gone from ci.yml, dependencies.yml and templates/sign-and-publish-caller.yml. Rust is now installed with rustup, which every GitHub-hosted runner image already has. The pinned commit was on master and had no version, so Dependabot could not move it. The MSRV job installs the declared rust-version and keeps RUSTUP_TOOLCHAIN. The template runs rustup target add for its matrix target, which the Intel macOS leg needs, with shell: bash so the step also works on Windows.

• New job colony-ui tests (windows-latest | macos-latest) runs cargo test -p colony-ui --locked. It covers the cfg(windows) and cfg(not linux) paths tests, including the Windows invariant that the cache dir is not the config dir. These tests never ran before.
  The first Windows run caught a test that had never run there. every_root_nests_under_the_vendor_then_the_program expected cache_dir to end in Colony/<Program>, but on Windows it ends in Colony\<Program>\cache by design. The test now drops that component on Windows. The code was already correct.

• New job action pins checks every uses: in .github/workflows/ and templates/, release.yml included, and fails when:

  • an action is not pinned to a full commit SHA;
  • a pin has no # vX version comment (the template's organisation pin of the shared workflow is exempt);
  • one action is pinned at two different commits.

  Dependabot never reads templates/, so a Dependabot bump of an action that the template also uses now stays red until the template is bumped in the same PR.

• actions/upload-artifact in sign-and-publish.yml goes from v7.0.1 to v7.0.2, the version the template already used, so the new check passes.

• persist-credentials: false on the checkouts in CI and in the dependencies workflow.

Docs

• design/dependencies.md: install Rust with rustup in CI, and what the action pins job enforces.
• design/releases.md: a routine action bump inside the shared workflow does not move the organisation pin by itself. It reaches callers with the next pin move, unless it fixes a security advisory. The pin stays at 619460ff for now.
• README.md:
  • a centred header with a tagline;
  • a > **Status:** blockquote in place of the old ## Status section;
  • a design rules index of the 10 pages;
  • a ## Code signing policy section, since this repository ships no binaries: colony-ui goes to crates.io through Trusted Publishing, and programs are signed by the shared workflow;
  • a ## Privacy section: the crates collect, store and send nothing, and paths only creates the directories it returns;
  • ## Licence renamed to ## License.

After merge

These repository settings are applied separately:

• default workflow token set to read, with can_approve_pull_request_reviews kept on;
• sha_pinning_required turned on;
• the default-branch ruleset gets a squash-only pull request rule and these required checks:
  • tokens and generated artifacts
  • MSRV
  • colony-ui tests (windows-latest)
  • colony-ui tests (macos-latest)
  • action pins

The open release PR #18 never started CI. It has to be closed and reopened before it can satisfy those checks.