GitHub Actions + Rust's Miri can leak your secrets in CI 🧵
If you run Miri in CI:
- upgrade to the 2026-09-22 nightly
- clear caches
- rotate any secrets that the `cargo miri` CI job had access to
GPT-6 Astra helped find this 🦀
Predrag Gruevski
@predr.ag
1.9K followers 387 following 662 posts
Querying (Almost) Everything // Frontier Systems @ OpenAI // Author of cargo-semver-checks & Trustfall // predr.ag/blog // ex Kensho // MIT alum // hachyderm.io/@predrag // not from around here 🇲🇰 // he-him
![cargo-semver-checks v0.50.0 release notes.
- Support for rustdoc JSON v61 for the latest nightly Rust
- One new lint: `auto_trait_impl_added`
- Bugfix in `constructible_struct_adds_field` to properly account for existing `pub` but `#[doc(hidden)]` fields.
- Support for parsing rustdocflags from `.cargo/config.toml` and some minor bugfixes
- Thanks to @taiki-e for accepting our upstream patches and promptly releasing them in `cargo-config2` so we can use them!](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:ifkx7vuhzzmbqfpnmfgjf4uk/bafkreibpgnvrxzy7ksqkekjhq4k5aubamzi2rkql7jdsrsz3c6hjowg4ea)
![cargo-semver-checks output where the "function now doc hidden" lint is triggered, warning that the "black_box" function in library/core/src/hint.rs is now #[doc(hidden)] and no longer public API. The run took 6.7s total.](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:ifkx7vuhzzmbqfpnmfgjf4uk/bafkreidv6zwdrkh3bdhtxhanrriiiofow73xnhrnpugfjueqolnm52tudy)
![fn breaks() -> impl Debug + ?Sized {
123
}
// error[E0277]: the size for values of type `impl Debug + ?Sized` cannot be known at compilation time
// --> src/lib.rs:3:16
// |
// 3 | fn breaks() -> impl Debug + ?Sized {
// | ^^^^^^^^^^^^^^^^^^^ doesn't have a size known at compile-time
// |
// = help: the trait `Sized` is not implemented for `impl Debug + ?Sized`
// = note: the return type of a function must have a statically known size
async fn works() -> impl Debug + ?Sized {
123
}
// no error!](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:ifkx7vuhzzmbqfpnmfgjf4uk/bafkreidum7zm3lqgosl4fkgoldnd4l52xgwizwuy7utqqsrgsg37gknbe4)
![pub trait Example {
unsafe fn demo(&self) {}
}
pub struct S;
impl Example for S {
// This isn't applied to the trait's fn!
#[target_feature(enable = "avx2,aes")]
unsafe fn demo(&self) {}
}
pub fn accept_dyn(value: &dyn Example) {
// SAFETY: umm ???
// Who knows what #[target_feature]
// attributes the trait impl has imposed?!
unsafe { value.demo() }
}](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:ifkx7vuhzzmbqfpnmfgjf4uk/bafkreice5ohtsih74ujhczjqmqd72qr6tsdr2jlun5lzcm66bd57zddo2i)
![## In this release
- 21 new lints, for a total of 148!
- Spotlight: `#[doc(hidden)]` and sealed lints
This release requires Rust 1.83+ both to install (MSRV) and at runtime. Future releases will require Rust 1.84+.
## Spotlight: `#[doc(hidden)]` and sealed lints
When is "this trait can be implemented" part of the trait's public API?
At a high level, the answer is: when writing an `impl` of that trait for our own type doesn't require using any `#[doc(hidden)]` items. But you've been following `cargo-semver-checks` long enough to know the *full answer* is much more complex. And getting the right answer here affects the correctness of a ton of lints!
Good news! This `cargo-semver-checks` release ships with a much more sophisticated system for analyzing whether traits can be implemented or are instead "sealed." The new system is more thorough, more nuanced, and faster to boot!
Read more about it here: https://predr.ag/blog/when-is-trait-can-be-implemented-public-api/](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:ifkx7vuhzzmbqfpnmfgjf4uk/bafkreiderjztsqrl763waig6mtx3qhevzixiq5yuv4icb2ggwtvpojo2vq)
![An example of a "public API sealed" trait is:
pub trait Example {
#[doc(hidden)]
type X;
}
Any impl of Example outside of its crate must name the Example::X item, and in doing so refer to non-public-API. Therefore, such an impl is outside the public API of Example, and may suffer breakage outside of major version bumps of Example's crate.
Crates can be public-API-sealed in many ways, including:
- #[doc(hidden)] (without #[deprecated]) on associated types without a default
- #[doc(hidden)] (without #[deprecated]) on associated constants without a default value
- #[doc(hidden)] (without #[deprecated]) on associated functions / methods without a default implementation
- associated functions / methods taking an "importable but not public API" parameter
- associated functions / methods returning an "importable but not public API" type
"Importable but not public API" means:
- The item has at least one path by which it can be imported from an external crate. That path passes through at least one item that is simultaneously #[doc(hidden)] and not #[deprecated], such as the imported item itself, a module, or a re-export).
- The item has no paths by which it can be imported such that no item along that path is #[doc(hidden)] and not #[deprecated].](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:ifkx7vuhzzmbqfpnmfgjf4uk/bafkreicrdkvh67txttqzyrwm6wilwdlq6o7vdw6vzmtecwrb7bj4hewdoy)
![Release notes screenshot:
In this release:
- 12 new lints, for a total of 106!
- Bugfix for packages using the "SemVer trick"
- Spotlight: Performance via parallelism
Spotlight: Performance via parallelism
cargo-semver-checks is on a trajectory of doubling its number of lints every year. But more lints mean more code scanning work to be done! And nobody likes slow tools, so we had to parallelize!
We began taking a serious look at performance in early 2023. Compared to that point ~almost two years ago:
- Lint checking time has reduced by 20%, in wall-clock terms & measured on the exact same hardware.
- Yet, we run over 2.5x as many lints in that time!
We've aimed to parallelize as much of the execution of the tool as possible, with help from the rayon library. Today, both the lint execution and the rustdoc indexing steps use rayon to distribute the work across all available cores on your system.
[It continues...]](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:ifkx7vuhzzmbqfpnmfgjf4uk/bafkreichlqippwy6zexmqfvvqxuega5suuzggyvqzyn36zybvg3yg7ryoe)
