Merge branch 'main' into d/readme

.cargo/config.toml

@@ -1,2 +1,7 @@
 [registries.crates-io]
 protocol = "sparse"
+
+[unstable]
+public-dependency = true
+cargo-lints = true
+codegen-backend = true

.clippy.toml

@@ -3,4 +3,4 @@ allow-expect-in-tests = true
 allow-print-in-tests = true
 suppress-restriction-lint-in-const = true
 doc-valid-idents = ["SpiceDB", "OpenAPI", ".."]
-allow-renamed-params-for = ["core::fmt::Debug", "core::fmt::Display", "futures_sink::Sink", ".."]
+allow-renamed-params-for = ["core::fmt::Debug", "core::fmt::Display", "futures_sink::Sink", "serde::de::Visitor", ".."]

.github/CODEOWNERS

@@ -4,4 +4,4 @@ LICENSE.txt @hashintel/legal
 LICENSE.md @hashintel/legal
 
 # Database migrations
-/apps/hash-graph/postgres_migrations/ @hashintel/db-admins
+/apps/hash-graph/libs/graph/postgres_migrations/ @hashintel/db-admins

.github/actions/build-docker-images/action.yml

@@ -58,7 +58,7 @@ runs:
 
     - name: Build hash-graph image
       if: inputs.hash-graph == 'true'
-      uses: docker/build-push-action@5cd11c3a4ced054e52742c5fd54dca954e0edd85 # v6.7.0
+      uses: docker/build-push-action@32945a339266b759abcbdc89316275140b0fc960 # v6.8.0
       with:
         context: .
         file: apps/hash-graph/docker/Dockerfile
@@ -85,14 +85,14 @@ runs:
 
     - name: Upload artifact
       if: ${{ (success() || failure()) && inputs.hash-graph == 'true' }}
-      uses: actions/upload-artifact@834a144ee995460fba8ed112a2fc961b36a5ec5a # v4.3.6
+      uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
       with:
         name: hash-graph
         path: /tmp/hash-graph.tar
 
     - name: Build hash-ai-worker-ts image
       if: inputs.hash-ai-worker-ts == 'true'
-      uses: docker/build-push-action@5cd11c3a4ced054e52742c5fd54dca954e0edd85 # v6.7.0
+      uses: docker/build-push-action@32945a339266b759abcbdc89316275140b0fc960 # v6.8.0
       with:
         context: .
         file: apps/hash-ai-worker-ts/docker/Dockerfile
@@ -110,14 +110,14 @@ runs:
 
     - name: Upload artifact
       if: ${{ (success() || failure()) && inputs.hash-ai-worker-ts == 'true' }}
-      uses: actions/upload-artifact@834a144ee995460fba8ed112a2fc961b36a5ec5a # v4.3.6
+      uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
       with:
         name: hash-ai-worker-ts
         path: /tmp/hash-ai-worker-ts.tar
 
     - name: Build hash-integration-worker image
       if: inputs.hash-integration-worker == 'true'
-      uses: docker/build-push-action@5cd11c3a4ced054e52742c5fd54dca954e0edd85 # v6.7.0
+      uses: docker/build-push-action@32945a339266b759abcbdc89316275140b0fc960 # v6.8.0
       with:
         context: .
         file: apps/hash-integration-worker/docker/Dockerfile
@@ -135,14 +135,14 @@ runs:
 
     - name: Upload artifact
       if: ${{ (success() || failure()) && inputs.hash-integration-worker == 'true' }}
-      uses: actions/upload-artifact@834a144ee995460fba8ed112a2fc961b36a5ec5a # v4.3.6
+      uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
       with:
         name: hash-integration-worker
         path: /tmp/hash-integration-worker.tar
 
     - name: Build hash-api image
       if: inputs.hash-api == 'true'
-      uses: docker/build-push-action@5cd11c3a4ced054e52742c5fd54dca954e0edd85 # v6.7.0
+      uses: docker/build-push-action@32945a339266b759abcbdc89316275140b0fc960 # v6.8.0
       with:
         context: .
         file: infra/docker/api/prod/Dockerfile
@@ -160,7 +160,7 @@ runs:
 
     - name: Upload artifact
       if: ${{ (success() || failure()) && inputs.hash-api == 'true' }}
-      uses: actions/upload-artifact@834a144ee995460fba8ed112a2fc961b36a5ec5a # v4.3.6
+      uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
       with:
         name: hash-api
         path: /tmp/hash-api.tar

.github/actions/docker-build-push/action.yml

@@ -61,7 +61,7 @@ runs:
 
     # Build images and push to ECR
     - name: Build and push ${{inputs.SHORTNAME}} image
-      uses: docker/build-push-action@5cd11c3a4ced054e52742c5fd54dca954e0edd85 # v6.7.0
+      uses: docker/build-push-action@32945a339266b759abcbdc89316275140b0fc960 # v6.8.0
       env:
         GH_RUN_ID: ${{ github.run_id }}
       with:

.github/actions/install-rust-toolchain/action.yml

@@ -3,7 +3,7 @@ description: "Install Rust toolchain"
 
 inputs:
   toolchain:
-    required: true
+    required: false
     description: "Rust toolchain, e.g. 'stable' or 'nightly'"
   working-directory:
     description: "Working directory to run the action in"
@@ -18,29 +18,34 @@ runs:
       run: |
         # regex for components that are only available on nightly and should not be installed on stable
         # these are in variables due to: https://stackoverflow.com/a/56449915/9077988
-        NIGHTLY_ONLY="miri|llvm-tools|llvm-tools-preview"
+        NIGHTLY_ONLY="miri|llvm-tools|llvm-tools-preview|rustc-codegen-cranelift-preview"
         NIGHTLY_TOOLCHAIN="nightly-.*"
 
         if [[ -f "${{ inputs.working-directory }}/rust-toolchain.toml" ]]; then
           RUST_TOOLCHAIN_FILE="${{ inputs.working-directory }}/rust-toolchain.toml"
         else
           RUST_TOOLCHAIN_FILE="rust-toolchain.toml"
         fi
-        # extract components from the rust-toolchain.toml 
+        # extract components from the rust-toolchain.toml
         COMPONENTS="$(cat $RUST_TOOLCHAIN_FILE | yq -p toml '.toolchain.components[]')"
 
-        rustup toolchain install "${{ inputs.toolchain }}"
+        if [[ "${{ inputs.toolchain }}" != "" ]]; then
+          TOOLCHAIN_CHANNEL="${{ inputs.toolchain }}"
+        else
+          TOOLCHAIN_CHANNEL="$(cat $RUST_TOOLCHAIN_FILE | yq -p toml '.toolchain.channel')"
+        fi
+        rustup toolchain install "$TOOLCHAIN_CHANNEL"
 
         for component in $COMPONENTS; do
           # depending on the toolchain we need to conditionally skip specific components
-          if [[ ! "${{ inputs.toolchain }}" =~ $NIGHTLY_TOOLCHAIN ]]; then
+          if [[ ! "$TOOLCHAIN_CHANNEL" =~ $NIGHTLY_TOOLCHAIN ]]; then
             # ensure that we only install components that are meant for stable
             if [[ ! $component =~ $NIGHTLY_ONLY ]]; then
-              rustup component add --toolchain "${{ inputs.toolchain }}" "$component"
+              rustup component add --toolchain "$TOOLCHAIN_CHANNEL" "$component"
             fi
           else
-            rustup component add --toolchain "${{ inputs.toolchain }}" "$component"  
+            rustup component add --toolchain "$TOOLCHAIN_CHANNEL" "$component"
           fi
         done
 
-        echo "RUSTUP_TOOLCHAIN=${{ inputs.toolchain }}" >> $GITHUB_ENV
+        echo "RUSTUP_TOOLCHAIN=$TOOLCHAIN_CHANNEL" >> $GITHUB_ENV

.github/actions/prune-repository/action.yml

@@ -26,7 +26,10 @@ runs:
           if [[ ! -f "out/$DIRECTORY/Cargo.toml" ]]; then
             mkdir -p "out/$DIRECTORY/src"
             echo > "out/$DIRECTORY/src/lib.rs"
-            echo -e "[package]\nname = \"$(yq '.package.name' -p toml -oy $line)\"" > "out/$DIRECTORY/Cargo.toml"
+            echo "cargo-features = [\"edition2024\"]" > "out/$DIRECTORY/Cargo.toml"
+            echo "[package]" >> "out/$DIRECTORY/Cargo.toml"
+            echo "name = \"$(yq '.package.name' -p toml -oy $line)\"" >> "out/$DIRECTORY/Cargo.toml"
+            echo "edition.workspace = true" >> "out/$DIRECTORY/Cargo.toml"
           fi
         done < <(find $(yq '.workspace.members' -p toml -o tsv Cargo.toml | tr '*' ' ') -maxdepth 2 -name Cargo.toml)
 

.github/actions/warm-up-repo/action.yml

@@ -11,13 +11,13 @@ runs:
   using: composite
 
   steps:
-    - uses: actions/setup-node@1e60f620b9541d16bece96c5465dc8ee9832be0b # v4.0.3
+    - uses: actions/setup-node@0a44ba7841725637a19e28fa30b79a866c81b0a6 # v4.0.4
       with:
         node-version: 20 ## aligned with Node version on Vercel
         # cache: yarn ## Currently disabled because of frequent timeouts
 
     - name: Install WASM tools
-      uses: taiki-e/install-action@e96513f64c39eb6ebc73e13b6e8470317202483a # v2.42.28
+      uses: taiki-e/install-action@9bef7e9c3d7c7aa986ef19933b0722880ae377e0 # v2.44.13
       with:
         tool: [email protected]
 

.github/dependabot.yml

@@ -0,0 +1,9 @@
+version: 2
+updates:
+  - package-ecosystem: "npm"
+    directories:
+      - "**/*"
+    schedule:
+      interval: "daily"
+    labels: []
+    open-pull-requests-limit: 0