chore(deps): bump loadingalias/cargo-rail-action from 8.2.0 to 10.0.0

[dependabot]

Bumps loadingalias/cargo-rail-action from 8.2.0 to 10.0.0.

Release notes

Sourced from loadingalias/cargo-rail-action's releases.

cargo-rail-action v10.0.0

• Add a native Linux ARM64 runtime and validate Cargo-Rail Surface preparation against its ready outcome. Bind planner, setup, cache, release, packaging, and validation to one published Cargo-Rail version and matching release commit while retaining a separate reviewed CI tooling commit. Preserve exact Cargo-Rail selections and publish the authenticated installed version to downstream jobs.

  Reuse one GitHub-hosted package workflow for CI and release validation. Generate SLSA provenance for every executable Action runtime and authorize only the asset-collection job to create attestations. Publish a stable cargo-rail-action launcher for later workflow steps without changing the authenticated target runtime's immutable installation.

  Allow immutable pre-release integrations to build and authenticate the checked-out Action runtime explicitly. Install the complete cataloged CI tool set on macOS, including Nextest, and honor the pinned Windows Bash path. Publish cache record paths in the Windows form accepted by GitHub artifact upload. Accept both released and current Cargo-Rail cache status contracts while strictly validating readiness, integrity, byte accounting, remote authority, and recoverable quarantine receipts. Reuse valid cache reports from earlier attempts of the same GitHub workflow run, prefer the latest report for each job, and reject reports from another run or a future attempt.

  Restrict the Action release workflow to manual main dispatches and fixed package, bump, publication, and review policy. Derive the Action runtime release from Cargo.toml and retain only the inputs required to resume a durable Cargo-Rail release transaction.

Full Changelog: loadingalias/cargo-rail-action@v9.0.1...v10.0.0

cargo-rail-action v9.0.1

• Default to Cargo-Rail v0.27.1 with corrected prebuilt installation and GitHub draft recovery. Accept stable v0.27.x releases while preserving support for stable v0.26.x releases.

cargo-rail-action v9.0.0

• Use the native Action runtime and compatible Cargo-Rail 0.26 components for independently validated planning, compiler-cache setup, and release execution. Install authenticated component archives, including their source license, and reject unknown or inconsistent contracts before exposing outputs. Accept LF and CRLF rows in release checksum files collected from native runners, while rejecting embedded carriage returns and ambiguous checksums.

  Add the release Action for caller-owned GitHub publication jobs. Validate the original release record, repository, workflow, dispatch, and reviewed merge before invoking Cargo-Rail. Expose the transaction ID, exact release commit, state, and executor URL. Recover the same request after runner loss without an Action-specific publication engine.

  Keep runtime manifest generation as product packaging. Delegate immutable releases and explicit major-tag promotion to Cargo-Rail, including conflict detection and recovery after uncertain effects.

Changelog

Sourced from loadingalias/cargo-rail-action's changelog.

Changelog

[10.0.0] - 2026-09-16

• Add a native Linux ARM64 runtime and validate Cargo-Rail Surface preparation against its ready outcome. Bind planner, setup, cache, release, packaging, and validation to one published Cargo-Rail version and matching release commit while retaining a separate reviewed CI tooling commit. Preserve exact Cargo-Rail selections and publish the authenticated installed version to downstream jobs.

  Reuse one GitHub-hosted package workflow for CI and release validation. Generate SLSA provenance for every executable Action runtime and authorize only the asset-collection job to create attestations. Publish a stable cargo-rail-action launcher for later workflow steps without changing the authenticated target runtime's immutable installation.

  Allow immutable pre-release integrations to build and authenticate the checked-out Action runtime explicitly. Install the complete cataloged CI tool set on macOS, including Nextest, and honor the pinned Windows Bash path. Publish cache record paths in the Windows form accepted by GitHub artifact upload. Accept both released and current Cargo-Rail cache status contracts while strictly validating readiness, integrity, byte accounting, remote authority, and recoverable quarantine receipts. Reuse valid cache reports from earlier attempts of the same GitHub workflow run, prefer the latest report for each job, and reject reports from another run or a future attempt.

  Restrict the Action release workflow to manual main dispatches and fixed package, bump, publication, and review policy. Derive the Action runtime release from Cargo.toml and retain only the inputs required to resume a durable Cargo-Rail release transaction.

[9.0.1] - 2026-09-13

• Default to Cargo-Rail v0.27.1 with corrected prebuilt installation and GitHub draft recovery. Accept stable v0.27.x releases while preserving support for stable v0.26.x releases.

[9.0.0] - 2026-09-13

• Use the native Action runtime and compatible Cargo-Rail 0.26 components for independently validated planning, compiler-cache setup, and release execution. Install authenticated component archives, including their source license, and reject unknown or inconsistent contracts before exposing outputs. Accept LF and CRLF rows in release checksum files collected from native runners, while rejecting embedded carriage returns and ambiguous checksums.

  Add the release Action for caller-owned GitHub publication jobs. Validate the original release record, repository, workflow, dispatch, and reviewed merge before invoking Cargo-Rail. Expose the transaction ID, exact release commit, state, and executor URL. Recover the same request after runner loss without an Action-specific publication engine.

  Keep runtime manifest generation as product packaging. Delegate immutable releases and explicit major-tag promotion to Cargo-Rail, including conflict detection and recovery after uncertain effects.

Commits

• e706767 chore(release): cargo-rail-action v10.0.0
• ce335de feat(action): prepare v10 release
• 530599f test(cache): preserve released status diagnostics
• 7424d06 fix(cache): accept current Cargo-Rail status contract
• 892afa0 fix(report): publish Windows-compatible record paths
• 7f00c67 fix(action): preserve released Cargo-Rail compatibility
• 3981fbf fix(ci): install nextest on macOS
• 74f7c9d feat(action): support authenticated source runtimes
• 254886f ci(action): authorize reusable package attestations
• 8d0452b feat(action): add Linux ARM64 runtime compatibility
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[Tryanks]

Superseded by #479. v10 of the action installs Cargo-Rail from the ≥0.26 component archives and needs plan contract v9, so the pinned 0.25.0 can no longer be installed (the 404 on SHA256SUMS in the Plan CI scope job); #479 moves to cargo-rail 0.29.0 and the v10 launcher and re-plans per platform.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.