Merge branch 'master' into dom/remove-getter-insecure-randomness-coll…

…ective-flip

.config/taplo.toml

@@ -33,3 +33,10 @@ keys = ["build"]
 
 [rule.formatting]
 reorder_arrays = false
+
+[[rule]]
+include = ["Cargo.toml"]
+keys = ["workspace.dependencies"]
+
+[rule.formatting]
+reorder_keys = true

.github/scripts/check-workspace.py

@@ -135,8 +135,12 @@ def check_deps(deps):
 				if dep_name in all_crates:
 					links.append((name, dep_name))
 
-					if not 'path' in deps[dep]:
-						broken.append((name, dep_name, "crate must be linked via `path`"))
+					if name == 'polkadot-sdk':
+						if not 'path' in deps[dep]:
+							broken.append((name, dep_name, "crate must use path"))
+							return
+					elif not 'workspace' in deps[dep] or not deps[dep]['workspace']:
+						broken.append((name, dep_name, "crate must use workspace inheritance"))
 						return
 
 		def check_crate(deps):
@@ -154,8 +158,6 @@ def check_crate(deps):
 
 		check_crate(manifest)
 
-
-
 	links.sort()
 	broken.sort()
 

.github/scripts/deny-git-deps.py

@@ -19,6 +19,7 @@
 
 root = sys.argv[1] if len(sys.argv) > 1 else os.getcwd()
 workspace = Workspace.from_path(root)
+errors = []
 
 def check_dep(dep, used_by):
 	if dep.location != DependencyLocation.GIT:
@@ -27,14 +28,23 @@ def check_dep(dep, used_by):
 	if used_by in KNOWN_BAD_GIT_DEPS.get(dep.name, []):
 		print(f'🤨 Ignoring git dependency {dep.name} in {used_by}')
 	else:
-		print(f'🚫 Found git dependency {dep.name} in {used_by}')
-		sys.exit(1)	
+		errors.append(f'🚫 Found git dependency {dep.name} in {used_by}')
 
 # Check the workspace dependencies that can be inherited:
 for dep in workspace.dependencies:
 	check_dep(dep, "workspace")
 
+	if workspace.crates.find_by_name(dep.name):
+		if dep.location != DependencyLocation.PATH:
+			errors.append(f'🚫 Workspace must use path to link local dependency {dep.name}')
+
 # And the dependencies of each crate:
 for crate in workspace.crates:
 	for dep in crate.dependencies:
 		check_dep(dep, crate.name)
+
+if errors:
+	print('❌ Found errors:')
+	for error in errors:
+		print(error)
+	sys.exit(1)

.github/workflows/check-prdoc.yml

@@ -6,7 +6,7 @@ on:
   merge_group:
 
 env:
-  IMAGE: docker.io/paritytech/prdoc:v0.0.7
+  IMAGE: docker.io/paritytech/prdoc:v0.0.8
   API_BASE: https://api.github.com/repos
   REPO: ${{ github.repository }}
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/check-semver.yml

@@ -5,6 +5,8 @@ on:
     types: [opened, synchronize, reopened, ready_for_review]
     paths:
       - prdoc/*.prdoc
+env:
+  TOOLCHAIN: nightly-2024-03-01
 
 jobs:
   check-semver:
@@ -19,14 +21,14 @@ jobs:
         with:
           cache-on-failure: true
 
+      - name: install parity-publish
+        run: cargo install [email protected]
+
       - name: Rust compilation prerequisites
         run: |
-          rustup default nightly-2024-03-01
-          rustup target add wasm32-unknown-unknown --toolchain nightly-2024-03-01
-          rustup component add rust-src --toolchain nightly-2024-03-01
-
-      - name: install parity-publish
-        run: cargo install [email protected]
+          rustup default $TOOLCHAIN
+          rustup target add wasm32-unknown-unknown --toolchain $TOOLCHAIN
+          rustup component add rust-src --toolchain $TOOLCHAIN
 
       - name: extra git setup
         run: |
@@ -39,7 +41,7 @@ jobs:
           export CARGO_TARGET_DIR=target
           export RUSTFLAGS='-A warnings -A missing_docs'
           export SKIP_WASM_BUILD=1
-          if ! parity-publish --color always prdoc --since old --validate prdoc/pr_$PR.prdoc --toolchain nightly-2024-03-01 -v; then
+          if ! parity-publish --color always prdoc --since old --validate prdoc/pr_$PR.prdoc -v --toolchain $TOOLCHAIN; then
             cat <<EOF
           👋 Hello developer! The SemVer information that you declared in the prdoc file did not match what the CI detected.
 

.github/workflows/checks-quick.yml

@@ -55,8 +55,14 @@ jobs:
       image: ${{ needs.set-image.outputs.IMAGE }}
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - name: fetch deps
+        run: |
+          # Pull all dependencies eagerly:
+          time cargo metadata --format-version=1 --locked > /dev/null
       - name: run zepter
-        run: zepter run check
+        run: |
+          zepter --version
+          time zepter run check
   test-rust-features:
     runs-on: ubuntu-latest
     timeout-minutes: 10

.github/workflows/publish-check-crates.yml

@@ -20,7 +20,7 @@ jobs:
           cache-on-failure: true
 
       - name: install parity-publish
-        run: cargo install parity-publish@0.5.1
+        run: cargo install parity-publish@0.6.0
 
       - name: parity-publish check
         run: parity-publish --color always check --allow-unpublished

.github/workflows/publish-claim-crates.yml

@@ -18,7 +18,7 @@ jobs:
           cache-on-failure: true
 
       - name: install parity-publish
-        run: cargo install parity-publish@0.5.1
+        run: cargo install parity-publish@0.6.0
 
       - name: parity-publish claim
         env: