From c5181a704bc2b5f940bbe88817b5b75a24a791f4 Mon Sep 17 00:00:00 2001
From: Ralf Anton Beier <ralf_beier@me.com>
Date: Tue, 11 Aug 2026 23:44:56 +0200
Subject: [PATCH] =?UTF-8?q?fix(ci):=20close=20the=20dependabot=20ignore=20?=
 =?UTF-8?q?gap=20=E2=80=94=20all=20cargo=20ecosystems,=20not=20just=20root?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Third re-float of the cranelift-isle pin (#298, #310, now #318). The previous
fix added a dependabot `ignore` for cranelift-isle, but scoped it to the root
cargo ecosystem only. #318 was titled "update cranelift-isle requirement in
/fuzz" and widened the ROOT workspace constraint to 0.134 anyway — the bot came
in through one of the four doors that were still open:

    /            ignore=[cranelift-isle]
    /fuzz        ignore=NONE      <- used this one
    /loom-cli    ignore=NONE
    /loom-core   ignore=NONE
    /loom-isle   ignore=NONE

A partial mechanical guard is a guard that has not been tested against the thing
it guards. Adding the entry to every cargo ecosystem, and re-pinning the root
constraint that #318 widened.

This is the same lesson the release gate in v1.3.0 carries, applied to my own
previous fix: the invariant has to be enforced everywhere it can be violated,
not everywhere I happened to look.

Refs #142, #304, #311
---
 .github/dependabot.yml | 24 ++++++++++++++++++++++++
 Cargo.toml             |  2 +-
 2 files changed, 25 insertions(+), 1 deletion(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index ed48070..1a33320 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -34,24 +34,48 @@ updates:
       interval: weekly
     labels:
       - dependencies
+    ignore:
+      # See the root (/) cargo entry for the full rationale. Repeated here
+      # because scoping the ignore to one ecosystem is NOT enough: #318 was
+      # titled "in /fuzz" and re-floated the ROOT workspace pin anyway. Every
+      # cargo ecosystem needs the entry or the bot finds the open door.
+      - dependency-name: cranelift-isle
   - package-ecosystem: cargo
     directory: /loom-cli
     schedule:
       interval: weekly
     labels:
       - dependencies
+    ignore:
+      # See the root (/) cargo entry for the full rationale. Repeated here
+      # because scoping the ignore to one ecosystem is NOT enough: #318 was
+      # titled "in /fuzz" and re-floated the ROOT workspace pin anyway. Every
+      # cargo ecosystem needs the entry or the bot finds the open door.
+      - dependency-name: cranelift-isle
   - package-ecosystem: cargo
     directory: /loom-core
     schedule:
       interval: weekly
     labels:
       - dependencies
+    ignore:
+      # See the root (/) cargo entry for the full rationale. Repeated here
+      # because scoping the ignore to one ecosystem is NOT enough: #318 was
+      # titled "in /fuzz" and re-floated the ROOT workspace pin anyway. Every
+      # cargo ecosystem needs the entry or the bot finds the open door.
+      - dependency-name: cranelift-isle
   - package-ecosystem: cargo
     directory: /loom-isle
     schedule:
       interval: weekly
     labels:
       - dependencies
+    ignore:
+      # See the root (/) cargo entry for the full rationale. Repeated here
+      # because scoping the ignore to one ecosystem is NOT enough: #318 was
+      # titled "in /fuzz" and re-floated the ROOT workspace pin anyway. Every
+      # cargo ecosystem needs the entry or the bot finds the open door.
+      - dependency-name: cranelift-isle
   - package-ecosystem: docker
     directory: /fuzz/oss-fuzz/projects/loom
     schedule:
diff --git a/Cargo.toml b/Cargo.toml
index 79f0149..3ab2708 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -32,7 +32,7 @@ wit-component = "0.255"
 # rustc 1.94.0) and reddened the wasm32-wasip2 build again — re-pinned here. Do
 # not widen the `^0.132` constraint without a stable rustc 1.94 or the committed
 # lockfile (#142); the float is what keeps reintroducing this red.
-cranelift-isle = "0.134"
+cranelift-isle = "0.132"
 
 # CLI
 clap = { version = "4.5", features = ["derive", "cargo"] }