Merge branch 'main' into bot-update-deps

.github/workflows/build/action.yaml

@@ -14,21 +14,18 @@ runs:
       if: ${{ contains(fromJSON('["pull_request"]'), github.event_name) }}
       id: cargo-deny
       run: |
-        set -xe
-        command -v cargo-deny >/dev/null 2>&1 || {
-          echo Installing cargo-deny >&2
-          cargo install --quiet cargo-deny
-        }
-        bin/cargo-deny-checks.sh
+        set -euxo pipefail
+        rye sync
+        rye run python3 scripts/cargo-deny-checks.py
       shell: bash
 
     - name: "Build and repin"
       id: build
       run: |
-        set -x
+        set -euxo pipefail
         rm -rf /home/runner/work/_temp/*/cache.tzst
         function bazel_build_auto_repin() {
-            local MYTMPDIR="$(mktemp -d)"
+            MYTMPDIR="$(mktemp -d)"
             trap 'rm -rf -- "$MYTMPDIR"' EXIT
             local logfile="$MYTMPDIR/bazel-out.log"
             local r=0
@@ -55,6 +52,7 @@ runs:
     - name: Commit files
       if: ${{ steps.build.outputs.repin == 'true' }}
       run: |
+        set -euxo pipefail
         CARGO_BAZEL_REPIN=true bazel build ... || return $?
         git config --local user.email "github-actions[bot]@users.noreply.github.com"
         git config --local user.name "github-actions[bot]"
@@ -74,9 +72,7 @@ runs:
       if: ${{ !startsWith(runner.name, 'dre-runner-custom') }}
       shell: bash
       run: |
-        #!/bin/bash
-
-        set -euo pipefail
+        set -euxo pipefail
         bazel query ... | grep -E "tarball$" | while IFS= read -r target; do
             echo "Testing $target"
             bazel run $target

.pre-commit-config.yaml

@@ -80,5 +80,4 @@ repos:
         language: script
         name: Cargo deny checks
         verbose: true
-        entry: bin/cargo-deny-checks.sh
-
+        entry: scripts/cargo-deny-checks.py