build(deps): update all Rust dependencies and fix lockfile refresh workflow

[anakrish]

Summary

Bulk-update all Rust dependencies to their latest compatible versions and fix the
dependabot-refresh-cargo-lockfiles workflow to prevent build failures on dependabot PRs.
Also hardens the workflow against expression injection vulnerabilities.

Problem

Dependabot security updates bypass the groups/directories configuration and create
one PR per Cargo.lock (e.g. PRs #678–#682 each bump rand in a single binding directory).
The existing refresh workflow only updated lockfiles for directories already changed in the PR,
so the other lockfiles remained at the old version — causing version skew and build failures.

Ref: dependabot/dependabot-core#7547

Changes

1. Dependency update (Cargo.lock × 6)

cargo update across root workspace and all bindings (ffi, java, python, ruby, wasm).
Supersedes individual dependabot PRs #678–#682.

2. Workflow fix: refresh ALL lockfiles

When any Cargo manifest or lockfile change is detected, refresh all lockfiles
unconditionally (including tests/ensure_no_std), rather than only the affected directory.

3. Workflow security hardening

• Expression injection fix (critical): moved head.ref from inline ${{ }}
  interpolation to env: variable with git check-ref-format --branch validation
  before use in git push
• Moved base_ref to env: with git check-ref-format validation
• Moved head.sha to env: with hex-40 regex validation
• Fetch base branch by ref (refs/heads/${BASE_REF}) instead of bare SHA for
  reliable diffing
• Added security boundary comment on the pull_request_target checkout step
• Added version comment on pinned actions/checkout SHA

Testing

• cargo check passes for root workspace and all bindings (ruby expected to fail locally
  without a Ruby installation)
• Pre-push hooks (build, fmt, clippy, doc-tests, OPA conformance) pass

[Copilot]

Pull request overview

Updates Rust dependency lockfiles across the repo and adjusts the dependabot lockfile refresh workflow to avoid dependency version skew across multiple Cargo.lock files.

Changes:

• Refreshed Cargo.lock in the root workspace and in each bindings workspace (ffi/java/python/ruby/wasm).
• Updated dependabot-refresh-cargo-lockfiles workflow to refresh all lockfiles whenever any Cargo manifest/lockfile changes are detected (plus tests/ensure_no_std).

Reviewed changes

Copilot reviewed 1 out of 7 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
Cargo.lock	Root workspace lockfile refreshed to latest compatible dependency versions.
bindings/ffi/Cargo.lock	FFI bindings workspace lockfile refreshed.
bindings/java/Cargo.lock	Java bindings workspace lockfile refreshed.
bindings/python/Cargo.lock	Python bindings workspace lockfile refreshed.
bindings/ruby/Cargo.lock	Ruby bindings workspace lockfile refreshed.
bindings/wasm/Cargo.lock	WASM bindings workspace lockfile refreshed.
.github/workflows/dependabot-refresh-cargo-lockfiles.yml	Workflow updated to refresh all lockfiles rather than only those in touched directories.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Bulk refresh of Rust dependency lockfiles across the workspace and language bindings, plus an update to the Dependabot lockfile-refresh workflow to avoid version skew across multiple Cargo.lock files on Dependabot PRs.

Changes:

• Updated Rust dependencies across the root workspace and binding lockfiles (cargo update-style refresh).
• Changed the Dependabot refresh workflow to refresh all lockfiles whenever any Cargo manifest/lockfile changes are detected.
• Added a fetch step intended to ensure the PR base commit is available locally for diffing in pull_request_target.

Reviewed changes

Copilot reviewed 1 out of 7 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
Cargo.lock	Root workspace lockfile refreshed to latest compatible dependency versions.
bindings/ffi/Cargo.lock	Binding lockfile refreshed to keep in sync with workspace dependency updates.
bindings/java/Cargo.lock	Binding lockfile refreshed to keep in sync with workspace dependency updates.
bindings/python/Cargo.lock	Binding lockfile refreshed to keep in sync with workspace dependency updates.
bindings/ruby/Cargo.lock	Binding lockfile refreshed to keep in sync with workspace dependency updates.
bindings/wasm/Cargo.lock	Binding lockfile refreshed to keep in sync with workspace dependency updates.
.github/workflows/dependabot-refresh-cargo-lockfiles.yml	Workflow adjusted to always refresh all lockfiles and to fetch the PR base commit for diffing.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Updates Rust dependencies across the workspace and all binding crates, and fixes the dependabot-refresh-cargo-lockfiles workflow so Dependabot PRs don’t end up with skewed Cargo.lock versions across directories (while also hardening the workflow against expression injection).

Changes:

• Bulk refresh Cargo.lock in the root workspace and each binding crate (ffi/java/python/ruby/wasm).
• Update the Dependabot lockfile-refresh workflow to refresh all lockfiles whenever any Cargo manifest/lockfile changes are detected (including tests/ensure_no_std).
• Add defense-in-depth validation and clearer security boundary documentation in the workflow.

Reviewed changes

Copilot reviewed 1 out of 7 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
Cargo.lock	Refresh root workspace lockfile to latest compatible dependency graph.
bindings/ffi/Cargo.lock	Refresh FFI binding lockfile to match updated dependency graph.
bindings/java/Cargo.lock	Refresh Java binding lockfile to match updated dependency graph.
bindings/python/Cargo.lock	Refresh Python binding lockfile to match updated dependency graph.
bindings/ruby/Cargo.lock	Refresh Ruby binding lockfile (notably includes bindgen/rb-sys updates).
bindings/wasm/Cargo.lock	Refresh WASM binding lockfile (incl. wasm-bindgen/wit-bindgen updates).
.github/workflows/dependabot-refresh-cargo-lockfiles.yml	Refresh all lockfiles unconditionally on Cargo changes; add SHA/ref validation and security commentary.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[anakrish]

Addressed the two unresolved review comments:

1. git fetch by SHA — Fixed. Now fetches by branch ref (refs/heads/${BASE_REF}) instead of bare SHA, and diffs against origin/${BASE_REF}. The BASE_REF is passed via env: from github.base_ref with format validation.

2. tests/ensure_no_std/Cargo.lock — Not an issue. tests/ensure_no_std is a workspace member (listed in root Cargo.toml [workspace] members), so it shares the root Cargo.lock — no separate lockfile is created by cargo metadata --manifest-path tests/ensure_no_std/Cargo.toml.

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Bulk-updates Rust dependencies while fixing the dependabot-refresh-cargo-lockfiles workflow so dependabot PRs don’t fail due to lockfile skew, and adds defense-in-depth hardening against expression injection in the workflow.

Changes:

• Refreshed Cargo.lock files across the workspace/bindings to align dependency versions.
• Updated the refresh workflow to regenerate all Cargo lockfiles upon any Cargo manifest/lockfile change (including tests/ensure_no_std).
• Hardened workflow handling of PR refs/SHAs (validation + safer fetch/diff/push patterns).

Comments suppressed due to low confidence (1)

.github/workflows/dependabot-refresh-cargo-lockfiles.yml:128

• If the refresh step produces no lockfile changes (e.g., everything is already up to date), lockfiles will be empty and git commit will fail with “nothing to commit” (due to set -e), breaking the workflow. Add an explicit guard to exit successfully when ${#lockfiles[@]} is 0 (or conditionally run commit/push only when git diff --cached --quiet is false after staging).

          mapfile -t lockfiles < <(git ls-files -m -o --exclude-standard -- ':(glob)**/Cargo.lock')

          for lockfile in "${lockfiles[@]}"; do
            git add "$lockfile"
          done

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 7 changed files in this pull request and generated 1 comment.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[anakrish]

Re: cargo metadata doesn't propagate version bumps

Good catch. Switched from cargo metadata to cargo update --manifest-path which actually resolves and updates locked versions. This ensures that when dependabot bumps a dep in one directory, the version propagates to all other lockfiles.

cargo update (like cargo metadata) does NOT execute build scripts — it only resolves dependencies and rewrites Cargo.lock — so it remains safe to run on untrusted PR code. Updated the security comment accordingly.

Also removed the separate tests/ensure_no_std metadata call since it shares the root Cargo.lock (workspace member) and cargo update --manifest-path Cargo.toml already covers it.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 7 changed files in this pull request and generated 2 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 7 changed files in this pull request and generated 3 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 7 changed files in this pull request and generated 3 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 7 changed files in this pull request and generated 3 comments.

Comments suppressed due to low confidence (1)

.github/workflows/dependabot-refresh-cargo-lockfiles.yml:1

• With persist-credentials: false, the checkout step will not configure credentials for origin, and the later git push does not set up authentication. Also, GH_TOKEN is an environment variable for GitHub CLI, but git push will not automatically use it. As written, the push step is likely to fail with an authentication error. Recommendation: explicitly configure git credentials for the push (e.g., set the origin HTTPS URL to include the token / configure http.*.extraheader), or enable persisted credentials in actions/checkout for this job if that matches the intended security posture.

# Copyright (c) Microsoft Corporation. All rights reserved.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.