[galoybot-app]

Bump Shared Tasks

This PR syncs in this repository, shared CI tasks from concourse-shared.

---

Note

Medium Risk
PR CI behavior changes via vendored workflow swaps (notably Rust audit moving back to actions-rs/audit-check) and major GitHub Action version bumps on Nix/check-code jobs.

Overview
Bumps the vendored shared CI snapshot by updating ci/vendir.yml / ci/vendir.lock.yml to galoy-concourse-shared commit e70b475 (merge of shared-actions bump PR #33), which refreshes .github/workflows/*, vendor workflow copies, and ci/vendor/* task scripts.

Rust security audit workflows (audit.yml and vendor rust-audit.yml) drop permissions: contents: read and replace the inline cargo install cargo-audit + cargo audit steps with actions-rs/audit-check@v1 (and actions/checkout@v3 instead of v6).

Check Code and Spelling workflows add permissions: contents: read, upgrade actions/checkout to v7, and on check-code bump DeterminateSystems Nix installer/cache actions (v23 / v15). Synced-file header comments are updated to point at the correct upstream repo name where they changed.

^{Reviewed by Cursor Bugbot for commit 46052e4. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want higher recall? High effort reviews run extra passes and find more bugs. A team admin can switch effort levels in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit 46052e4. Configure here.}

[cursor]

Audit workflow reverts to archived action

High Severity

The Audit workflow drops the direct cargo audit run and switches back to archived actions-rs/audit-check@v1, while also removing permissions: contents: read. That action reports through the legacy Checks API and is the path the previous vendor pin existed to avoid, so pull-request security audits can fail or stop reporting vulnerabilities.

Additional Locations (1)

• .github/workflows/vendor/rust-audit.yml#L9-L17

 

^{Reviewed by Cursor Bugbot for commit 46052e4. Configure here.}

[github-actions]

📊 Performance Report

Commit: 46052e4
Updated: 2026-10-20 12:36:28 UTC

Cala Performance Benchmark Results (non-representative)

Criterion Benchmark Results (single-threaded)

Benchmark	Time per Run	Throughput	% vs Baseline
post_simple_transaction	3.038ms	329 tx/s	0 (baseline)
post_backdated_transaction_with_effective_balances_365_days	13.897ms	71 tx/s	-357.0%
post_multi_layer_transaction	3.378ms	296 tx/s	-11.0%
post_simple_transaction_with_effective_balances	3.671ms	272 tx/s	-20.0%
post_simple_transaction_with_skipped_velocity	3.031ms	329 tx/s	-0.0%
post_simple_transaction_with_velocity	3.304ms	302 tx/s	-8.0%
post_simple_transaction_with_hit_velocity	1.726ms	579 tx/s	+43.0%
post_simple_transaction_with_one_account_set	3.294ms	303 tx/s	-8.0%
post_simple_transaction_with_five_account_sets	3.507ms	285 tx/s	-15.0%
post_simple_transaction_with_ec_account_set	3.096ms	322 tx/s	-1.0%

Load Testing Results (parallel-execution)

Scenario	tx/s
1 parallel	229.09
2 parallel	358.56
5 parallel	498.28
10 parallel	451.59
20 parallel	468.38
2 contention	270.13
5 contention	255.04
2 acct_sets	197.64
5 acct_sets	193.83

---

Note: Performance results may vary based on system resources and database state.

Last updated by commit 46052e4