Merge branch 'main' into dependabot/github_actions/actions/attest-build-provenance-4

Author: unclesp1d3r

.gitattributes

@@ -78,4 +78,8 @@ LICENSE text
 *.so binary
 *.dylib binary
 
+# Test fixture binaries
+tests/fixtures/test_empty.bin binary
+tests/fixtures/test_unknown.bin binary
+
 .env text=utf-8 eol=lf

.github/copilot-instructions.md

@@ -67,8 +67,11 @@ Container parsers assign weights (1.0-10.0) to sections based on string likeliho
 Strings are grouped by `(text, encoding)` tuple in a `HashMap<(String, Encoding), Vec<StringOccurrence>>`:
 
 - **Preserve all occurrences**: Each occurrence captures offset, RVA, section, source, tags, score, confidence
+
 - **Tag merging**: Union all tags via `HashSet`, then sort
+
 - **Combined scoring formula**:
+
   ```text
   base_score = max(occurrence.original_score)
   occurrence_bonus = 5 * (count - 1)

.github/workflows/audit.yml

@@ -22,6 +22,6 @@ jobs:
       contents: read
       issues: write
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions-rust-lang/audit@v1
+      - uses: actions/checkout@v6.0.2
+      - uses: actions-rust-lang/audit@v1.2.7
         name: Audit Rust Dependencies

.github/workflows/ci.yml

@@ -24,17 +24,23 @@ jobs:
   quality:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
       - uses: dtolnay/rust-toolchain@efa25f7f19611383d5b0ccf2d1c8914531636bf9
         with:
           components: rustfmt, clippy
           toolchain: 1.93.0
-      - uses: jdx/mise-action@v3
+      - uses: jdx/mise-action@v3.6.3
         with:
           install: true
           cache: true
           github_token: ${{ secrets.GITHUB_TOKEN }}
 
+      - name: Ensure rustfmt and clippy are installed
+        run: rustup component add rustfmt clippy
+
+      - name: Cache Rust dependencies
+        uses: Swatinem/rust-cache@v2.8.2
+
       - name: Rustfmt Check
         run: cargo fmt --all -- --check
 
@@ -52,28 +58,31 @@ jobs:
           - toolchain: stable minus 3 releases
           - toolchain: stable minus 4 releases
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
       - uses: dtolnay/rust-toolchain@efa25f7f19611383d5b0ccf2d1c8914531636bf9
         with:
           components: rustfmt, clippy
           toolchain: ${{ matrix.toolchain }}
 
       - name: Cache Rust dependencies
-        uses: Swatinem/rust-cache@v2
+        uses: Swatinem/rust-cache@v2.8.2
 
       - name: Check MSRV compliance
         run: cargo check --all-features
 
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: jdx/mise-action@v3
+      - uses: actions/checkout@v6.0.2
+      - uses: jdx/mise-action@v3.6.3
         with:
           install: true
           cache: true
           github_token: ${{ secrets.GITHUB_TOKEN }}
 
+      - name: Generate test fixtures
+        run: just gen-fixtures
+
       - name: Run tests (all features)
         run: just test-ci
 
@@ -93,13 +102,16 @@ jobs:
 
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v6
-      - uses: jdx/mise-action@v3
+      - uses: actions/checkout@v6.0.2
+      - uses: jdx/mise-action@v3.6.3
         with:
           install: true
           cache: true
           github_token: ${{ secrets.GITHUB_TOKEN }}
 
+      - name: Generate test fixtures
+        run: just gen-fixtures
+
       - name: Run tests (all features)
         run: just test-ci
       - name: Build release
@@ -109,18 +121,21 @@ jobs:
     runs-on: ubuntu-latest
     needs: [test, test-cross-platform]
     steps:
-      - uses: actions/checkout@v6
-      - uses: jdx/mise-action@v3
+      - uses: actions/checkout@v6.0.2
+      - uses: jdx/mise-action@v3.6.3
         with:
           install: true
           cache: true
           github_token: ${{ secrets.GITHUB_TOKEN }}
 
+      - name: Generate test fixtures
+        run: just gen-fixtures
+
       - name: Generate coverage
         run: just coverage
 
       - name: Upload to Codecov
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@v5.5.2
         with:
           files: lcov.info
           fail_ci_if_error: false

.github/workflows/codeql.yml

@@ -19,9 +19,9 @@ jobs:
     name: CodeQL Analyze
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
 
-      - uses: jdx/mise-action@v3
+      - uses: jdx/mise-action@v3.6.3
         with:
           install: true
           cache: true

.github/workflows/copilot-setup-steps.yml

@@ -22,9 +22,9 @@ jobs:
       contents: read
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
 
-      - uses: jdx/mise-action@v3
+      - uses: jdx/mise-action@v3.6.3
         with:
           install: true
           cache: true

.github/workflows/docs.yml

@@ -25,9 +25,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.2
 
-      - uses: jdx/mise-action@v3
+      - uses: jdx/mise-action@v3.6.3
         with:
           install: true
           cache: true
@@ -59,4 +59,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@v4.0.5

.github/workflows/release.yml

@@ -64,9 +64,9 @@ jobs:
         # we specify bash to get pipefail; it guards against the `curl` command
         # failing. otherwise `sh` won't catch that `curl` returned non-0
         shell: bash
-        run: "curl --proto '=https' --tlsv1.2 -LsSf https://github.com/axodotdev/cargo-dist/releases/download/v0.30.3/cargo-dist-installer.sh | sh"
+        run: "curl --proto '=https' --tlsv1.2 -LsSf https://github.com/axodotdev/cargo-dist/releases/download/v0.31.0/cargo-dist-installer.sh | sh"
       - name: Cache dist
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: cargo-dist-cache
           path: ~/.cargo/bin/dist
@@ -82,7 +82,7 @@ jobs:
           cat plan-dist-manifest.json
           echo "manifest=$(jq -c "." plan-dist-manifest.json)" >> "$GITHUB_OUTPUT"
       - name: "Upload dist-manifest.json"
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: artifacts-plan-dist-manifest
           path: plan-dist-manifest.json
@@ -135,7 +135,7 @@ jobs:
         run: ${{ matrix.install_dist.run }}
       # Get the dist-manifest
       - name: Fetch local artifacts
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
           pattern: artifacts-*
           path: target/distrib/
@@ -168,7 +168,7 @@ jobs:
 
           cp dist-manifest.json "$BUILD_MANIFEST_NAME"
       - name: "Upload artifacts"
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: artifacts-build-local-${{ join(matrix.targets, '_') }}
           path: |
@@ -190,7 +190,7 @@ jobs:
           persist-credentials: false
           submodules: recursive
       - name: Install cached dist
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
           name: cargo-dist-cache
           path: ~/.cargo/bin/
@@ -202,7 +202,7 @@ jobs:
         shell: bash
       # Get all the local artifacts for the global tasks to use (for e.g. checksums)
       - name: Fetch local artifacts
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
           pattern: artifacts-*
           path: target/distrib/
@@ -233,7 +233,7 @@ jobs:
             find . -name '*.cdx.xml' | tee -a "$GITHUB_OUTPUT"
             echo "EOF" >> "$GITHUB_OUTPUT"
       - name: "Upload artifacts"
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: artifacts-build-global
           path: |
@@ -259,14 +259,14 @@ jobs:
           persist-credentials: false
           submodules: recursive
       - name: Install cached dist
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
           name: cargo-dist-cache
           path: ~/.cargo/bin/
       - run: chmod +x ~/.cargo/bin/dist
       # Fetch artifacts from scratch-storage
       - name: Fetch artifacts
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
           pattern: artifacts-*
           path: target/distrib/
@@ -279,14 +279,14 @@ jobs:
           cat dist-manifest.json
           echo "manifest=$(jq -c "." dist-manifest.json)" >> "$GITHUB_OUTPUT"
       - name: "Upload dist-manifest.json"
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           # Overwrite the previous copy
           name: artifacts-dist-manifest
           path: dist-manifest.json
       # Create a GitHub Release while uploading all files to it
       - name: "Download GitHub Artifacts"
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
           pattern: artifacts-*
           path: artifacts
@@ -326,7 +326,7 @@ jobs:
           token: ${{ secrets.HOMEBREW_TAP_TOKEN }}
       # So we have access to the formula
       - name: Fetch homebrew formulae
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
           pattern: artifacts-*
           path: Formula/

.github/workflows/scorecard.yml

@@ -26,7 +26,7 @@ jobs:
 
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.2
         with:
           persist-credentials: false
 
@@ -38,7 +38,7 @@ jobs:
           publish_results: true
 
       - name: "Upload artifact"
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: SARIF file
           path: results.sarif

.github/workflows/security.yml

@@ -24,9 +24,9 @@ jobs:
   audit:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
 
-      - uses: jdx/mise-action@v3
+      - uses: jdx/mise-action@v3.6.3
         with:
           install: true
           cache: true