[M3gA-Mind]

Summary

AMR minimum Rust (1.91) has failed on every main commit since dependabot's ac088c3 ("ci: bump the github-actions group"). That commit moved dtolnay/rust-toolchain@1.91.0 to @1.120.0. The action takes the toolchain from its ref, so the job asks rustup for Rust 1.120.0, which doesn't exist ("could not download nonexistent rust version 1.120.0-x86_64-unknown-linux-gnu"), and fails in about 7s before any build. Main is red at f8fbdbc, 7000fc3 and 26c72d5, and the same check fails on #61.

• .github/workflows/ci.yml:19: back to dtolnay/rust-toolchain@1.91.0, the declared minimum (rust-version = "1.91" for tinyvoice and tinyvoice-module).
• .github/dependabot.yml: ignore dtolnay/rust-toolchain in the github-actions group. Its tags are Rust versions, not action releases, so it must never be "upgraded".

Test plan

• GitHub CI on this head: AMR minimum Rust (1.91) green.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 48a07313-7f82-44c5-b6de-3ba5739751a4

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[tinysweeper]

Tiny Sweeper review

Reviewed head: 832f14777228ab4b1638640c4845575e9f1eb335

Verdict: Ready for maintainer review · Priority: none
Coverage: Reviewed 2 of 2 files.
Pull request purpose (title): ci: pin the MSRV job…

Diagnostics and supporting details

Full summary

Pull request purpose (title): ci: pin the MSRV job back to Rust 1.91. The change pins the MSRV job back to `dtolnay/rust-toolchain@1.91.0` in `.github/workflows/ci.yml` and adds a dependabot ignore entry for the `dtolnay/rust-toolchain` dependency in `.github/dependabot.yml` so its tags are not treated as action releases.

Review snapshot

Change surface	Files	Review signal	Count
Production	0	Active findings	0
Tests	0	Noted findings	0
Documentation	0	Resolved findings	0
Configuration	2	Pending checks/questions	0

Completeness: Complete
Test assessment: No supported feature-to-test mapping was available; this does not mean tests are absent or passed.

What changed

The change reverts the MSRV job's toolchain pin in `.github/workflows/ci.yml` from `dtolnay/rust-toolchain@1.120.0` back to `@1.91.0`, matching the declared minimum Rust version, and adds an ignore entry for the `dtolnay/rust-toolchain` dependency in `.github/dependabot.yml` so its Rust-version tags are never treated as action releases for upgrade. No permissions are widened, both action refs remain pinned to specific tags, and no untrusted context is interpolated into a shell.

Features

• Added — Dependabot ignore for dtolnay/rust-toolchain: Dependabot will no longer propose upgrading the `dtolnay/rust-toolchain` ref as part of the github-actions group, preventing future bumps from a Rust-version tag to a nonexistent toolchain version and keeping the MSRV job pinned to the declared minimum. (.github/dependabot.yml updates:)

Tests

No supported feature-to-test mapping was produced. Test execution is not inferred.

Findings

No active actionable findings.

Before merge

None.

Agent review details

critique

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: The critique lane answered with zero findings after reviewing both changed files.
• Lane summary: Reviewed 2 files; 0 findings.

security

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: The security lane answered with zero findings after reviewing both changed files.
• Lane summary: Reviewed 2 files; 0 findings.

tests

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: No behavioural change: nothing outside documentation, configuration and tests.

commits

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: The commits lane answered reporting no sensitive content in the committed files.
• Lane summary: No sensitive content in committed files.

description

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: The description lane answered with zero findings, reporting that the diff does exactly what the description says, that neither change widens `permissions`, that both action refs remain pinned to a specific tag, and that no untrusted context is interpolated into a shell.
• Lane summary: The diff does exactly what the description says: it reverts the MSRV job's toolchain pin in `.github/workflows/ci.yml` from `dtolnay/rust-toolchain@1.120.0` back to `@1.91.0` and adds a dependabot ignore entry so the action's tag is not treated as an action release. Neither change widens `permissions`, introduces an unpinned action (both refs are pinned to a specific tag), or interpolates untrusted context into a shell, so the path-specific rules are satisfied. The description is accurate and complete for this narrow CI fix; I found nothing reportable.

Evidence and run details

• Models: ladder/vectors-oai3, deepseek-v4.1-flash
• Spend: $0.000901
• Tokens: 130458 input · 2414 output · 22528 cached · 57 embedding
• Updated: 2026-10-26T08:21:53Z

Head	State	Pass summary
832f14777228	ready for maintainer review	0 active finding(s), 0 resolved finding(s) (at 2026-10-26T08:21:53Z)

[tinysweeper]

tinysweeper found nothing blocking. Approving.

Diagnostics

Total spend: $0.0009