From c83d3fb9630daf7e033a6f6e57b4f16ce95e59ca Mon Sep 17 00:00:00 2001 From: HackingGate Date: Wed, 19 Aug 2026 21:21:30 +0900 Subject: [PATCH] uphold 1.5.0: one set, for a tool installed by hand rather than by a resolver Minor. One bundled set is added and nothing existing changes shape: the fourteen sets a 1.4.x policy can name resolve to exactly the rules they resolved to before, and every top-level field is the field it was. THERE IS A REINSTALL REQUIREMENT, and it is the same one 1.4.0 had. A set ships compiled into the binary, so a policy naming `hand-rolled-toolchain` against a 1.4.x binary does not fall back or warn -- the set does not resolve, the policy fails to load, and a `git` or `gh` shim built on that policy fails closed. Bump the pin and reinstall in the same change, or do not name the set yet. No repository is affected until it names it. WHAT THE SET REFUSES. A host tool fetched and unpacked by hand where a version manager was available: no-hand-rolled-tool-install a fetch piped into an unpacker no-hand-rolled-tool-symlink an `ln -s` onto PATH out of $HOME/.local Promoted on a sweep that found the same Zig tarball installer written out in ten repositories -- same `uname -m` case, same two architectures, same ~/.local/zig, same `ln -sf` -- beside four further bespoke answers to the same question in one workspace. The cost is not the duplication: a hand-written installer is untested on the platform it will fail on, and the measured failures are all of that shape -- a `mv` into a ~/.local that does not exist yet on a fresh runner, and a vendor release with no Linux asset on the architecture nobody developed on. Both rules fire on a COMMAND rather than on a declaration. What the set deliberately leaves alone is argued in its header: `curl ... | sh`, because that is how a version manager itself arrives; a [[tool]] row or a `want`, because a resolver provisions and a doctor verifies and the two must be different programs; and distro packages, because refusing those pushes a repository toward vendoring by hand, which is this set's own failure arriving from the other side. `unmanaged-pins` does not already cover this and cannot: every one of the ten builds its URL out of shell variables, so there is no version in the line to match. --- Cargo.lock | 2 +- Cargo.toml | 2 +- README.md | 6 +++--- hooks/lefthook.yml | 4 ++-- 4 files changed, 7 insertions(+), 7 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 574a298..45d3369 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -583,7 +583,7 @@ checksum = "673aac59facbab8a9007c7f6108d11f63b603f7cabff99fabf650fea5c32b861" [[package]] name = "uphold" -version = "1.4.1" +version = "1.5.0" dependencies = [ "encoding_rs", "globset", diff --git a/Cargo.toml b/Cargo.toml index bb52012..7957dff 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "uphold" -version = "1.4.1" +version = "1.5.0" edition = "2021" # 1.88, not 1.85: the ripgrep stack this crate embeds -- globset 0.4.20 and # ignore 0.4.33 in Cargo.lock -- refuses anything older. The 1.85 that stood here diff --git a/README.md b/README.md index a916a97..3f3ee95 100644 --- a/README.md +++ b/README.md @@ -25,7 +25,7 @@ bootstraps). default_install_hook_types: [pre-commit, commit-msg, pre-merge-commit, pre-push] repos: - repo: https://github.com/HackingGate/uphold - rev: v1.4.1 + rev: v1.5.0 hooks: - id: uphold-check # the claims still hold - id: uphold-scan # the content policy @@ -48,13 +48,13 @@ the binary must be on PATH. # lefthook.yml remotes: - git_url: https://github.com/HackingGate/uphold - ref: v1.4.1 + ref: v1.5.0 configs: - hooks/lefthook.yml ``` ```sh -cargo install --git https://github.com/HackingGate/uphold --tag v1.4.1 +cargo install --git https://github.com/HackingGate/uphold --tag v1.5.0 ``` That `ref:` is the one version a lefthook consumer pins, and **Dependabot does diff --git a/hooks/lefthook.yml b/hooks/lefthook.yml index f16cabf..7546c1d 100644 --- a/hooks/lefthook.yml +++ b/hooks/lefthook.yml @@ -10,7 +10,7 @@ # # lefthook.yml, in the consuming repository # remotes: # - git_url: https://github.com/HackingGate/uphold -# ref: v1.4.1 +# ref: v1.5.0 # configs: # - hooks/lefthook.yml # @@ -21,7 +21,7 @@ # their manifest contract; lefthook runs commands and has no such contract, so # `uphold` must be on PATH: # -# cargo install --git https://github.com/HackingGate/uphold --tag v1.4.1 +# cargo install --git https://github.com/HackingGate/uphold --tag v1.5.0 # # The names below are prefixed `uphold-` on purpose. A remote config is # merged into the consumer's own, and two commands sharing a name under one hook