From c7626269dba9b7f25fda9ae71577dbfb211e5046 Mon Sep 17 00:00:00 2001 From: Atif Nazir Date: Fri, 23 Oct 2026 16:56:27 -0700 Subject: [PATCH] Embed the dependency list in release binaries; release 0.7.7 --- .github/workflows/release.yml | 3 +++ CHANGELOG.md | 10 +++++++++- Cargo.lock | 2 +- Cargo.toml | 2 +- dist-workspace.toml | 4 ++++ 5 files changed, 18 insertions(+), 3 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 935b6d8..98a0564 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -140,6 +140,9 @@ jobs: pattern: artifacts-* path: target/distrib/ merge-multiple: true + # Edited by hand: a fixed cargo-auditable version instead of the latest installer + - name: Install cargo-auditable + run: cargo install --locked cargo-auditable@0.7.7 - name: Install dependencies run: | ${{ matrix.packages_install }} diff --git a/CHANGELOG.md b/CHANGELOG.md index bd82dc7..d073c62 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -10,6 +10,13 @@ names, environment variables, exit codes, error codes, and the shape of ## [Unreleased] +## [0.7.7] - 2026-10-23 + +### Changed + +- Release binaries embed their dependency list, so `cargo audit bin` can + check an installed `dogechain` directly. + ## [0.7.6] - 2026-10-22 ### Security @@ -195,7 +202,8 @@ names, environment variables, exit codes, error codes, and the shape of - Installers: Homebrew (`blockio/tap/dogechain`), npm (`dogechain`), shell script, PowerShell, and prebuilt binaries for macOS, Linux and Windows. -[Unreleased]: https://github.com/BlockIo/dogechain-cli/compare/v0.7.6...HEAD +[Unreleased]: https://github.com/BlockIo/dogechain-cli/compare/v0.7.7...HEAD +[0.7.7]: https://github.com/BlockIo/dogechain-cli/compare/v0.7.6...v0.7.7 [0.7.6]: https://github.com/BlockIo/dogechain-cli/compare/v0.7.5...v0.7.6 [0.7.5]: https://github.com/BlockIo/dogechain-cli/compare/v0.7.4...v0.7.5 [0.7.4]: https://github.com/BlockIo/dogechain-cli/compare/v0.7.3...v0.7.4 diff --git a/Cargo.lock b/Cargo.lock index 7bcf3df..518ce0a 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -342,7 +342,7 @@ dependencies = [ [[package]] name = "dogechain-cli" -version = "0.7.6" +version = "0.7.7" dependencies = [ "assert_cmd", "clap", diff --git a/Cargo.toml b/Cargo.toml index 0c54c54..5b1e1c3 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "dogechain-cli" -version = "0.7.6" +version = "0.7.7" edition = "2024" rust-version = "1.88" description = "Command-line interface for Dogechain.com" diff --git a/dist-workspace.toml b/dist-workspace.toml index 40fac76..93afd4c 100644 --- a/dist-workspace.toml +++ b/dist-workspace.toml @@ -27,6 +27,10 @@ install-updater = false github-custom-job-permissions = { "publish-npm" = { contents = "read", id-token = "write" } } # Sign release artifacts with GitHub build provenance attestations github-attestations = true +# Embed the dependency list in binaries so `cargo audit bin` can check them +cargo-auditable = true +# release.yml installs a fixed cargo-auditable version; re-apply that edit after `dist generate` +allow-dirty = ["ci"] # Pin third-party actions to exact commits [dist.github-action-commits]