fix(ci): remove weekly MSRV release run
This commit is contained in:
@@ -14,11 +14,9 @@ missing, or the dependency lacks an implemented responsibility in
|
||||
consumer and dependency scope, all approved duplicate sets, native direct
|
||||
dependencies, review dates, and the resolved external package count.
|
||||
|
||||
The policy intentionally distinguishes Rust 1.96.0, the minimum supported Rust
|
||||
version, from current stable Rust used for development and release validation.
|
||||
The release matrix checks both. Raising the MSRV requires an explicit policy,
|
||||
matrix, documentation, and changelog review; ordinary dependency updates may
|
||||
not raise it accidentally.
|
||||
Development and release validation use the current stable Rust toolchain pinned
|
||||
by the workflows. Dependency review records compiler requirements without
|
||||
installing or testing an additional historical toolchain.
|
||||
|
||||
## Automated gates
|
||||
|
||||
@@ -67,7 +65,7 @@ The graph is reviewed at least quarterly using `reviewed_on` and `review_by`.
|
||||
RustSec advisories are reviewed immediately. For every update:
|
||||
|
||||
1. identify the implemented caller and confirm the dependency remains needed;
|
||||
2. inspect release notes, maintenance state, license, MSRV, enabled features,
|
||||
2. inspect release notes, maintenance state, license, compiler requirements, enabled features,
|
||||
native code, and target-specific build behavior;
|
||||
3. update one crate deliberately with `cargo update -p NAME --precise VERSION`;
|
||||
4. rerun the dependency audit, `cargo-deny`, `cargo-machete`, and the affected
|
||||
|
||||
Reference in New Issue
Block a user