CI Failure DoctorCI Failure Investigation - Run #23529112132 (fastembed 5.13.0 bump)

[github-actions[bot]]

Summary

CI workflow run #23529112132 failed after merging PR #159, which bumped fastembed from 5.12.1 to 5.13.0 via Dependabot.

Failure Details

• Run: 23529112132
• Commit: 3fa0e5d105b8ebfa8802002edc5fb117ebb237bf
• Trigger: push to main (merged Dependabot PR deps: bump fastembed from 5.12.1 to 5.13.0 #159)
• Change: fastembed 5.12.1 → 5.13.0

Root Cause Analysis

⚠️ Note: Direct CI log access requires an authenticated GitHub CLI, which was unavailable in this environment. The analysis below is based on static analysis of the codebase, Cargo.lock, and deny.toml.

The most likely root causes, in order of probability:

1. 🔴 cargo deny Advisory Failure (Most Likely)

fastembed 5.13.0 updated its transitive dependency tree (notably hf-hub 0.4.3, ndarray 0.17.2, and ureq 3.1.4). The dependency tree now includes 336 packages. If any of those received a new RUSTSEC advisory after 5.12.1 shipped, cargo deny check would fail because deny.toml only ignores RUSTSEC-2024-0436 (paste unmaintained).

Packages at higher advisory risk in the current lock:

• openssl 0.10.75 (openssl-sys linkage)
• socks 0.3.4 (older proxy crate)
• hf-hub 0.4.3 (model download crate, known focus of security researchers)
• ureq 2.12.1 and ureq 3.1.4 (two concurrent versions present)

2. 🟡 Compilation Failure (API Change in fastembed 5.13.0)

The code in src/embedding/fastembed_impl.rs calls model.embed(texts, None) where model is a fastembed::TextEmbedding. If fastembed 5.13.0 changed the method signature (e.g., changed from impl IntoIterator(Item=&str) to a different type bound, or removed the batch_size parameter), this would cause a compile error in all jobs (clippy, test, msrv, doc).

Relevant code locations:

• src/embedding/fastembed_impl.rs:74 — model.embed(texts, None) (single text)
• src/embedding/fastembed_impl.rs:137 — model.embed(texts, None) (batch)

3. 🟠 Windows Test Failure (Platform-specific)

The CI runs cargo test --features fastembed-embeddings on Windows (without usearch-hnsw). If fastembed 5.13.0 introduced a dependency that doesn't compile on Windows (e.g., POSIX-specific code similar to the usearch 2.24.0 MAP_FAILED issue), the Windows test job would fail.

Failed Jobs and Errors

Without direct log access, the most likely failing jobs are:

Job	Status	Why
deny	❌ Failed	New RUSTSEC advisory from updated transitive deps
clippy	❌ Failed (if API change)	fastembed 5.13.0 API breakage
test (windows-latest)	❌ Failed (if platform issue)	Windows-specific dependency issue

Investigation Findings

Static analysis of Cargo.lock:

• 336 total packages in the dependency tree
• deny.toml only has RUSTSEC-2024-0436 (paste) in the ignore list
• Two concurrent versions of ureq present: 2.12.1 and 3.1.4
• openssl 0.10.75 is in the tree via native-tls (from tokenizers/hf-hub)
• hf-hub bumped from a previous version to 0.4.3

fastembed API usage in src/embedding/fastembed_impl.rs:

let options = fastembed::InitOptions::new(fastembed::EmbeddingModel::BGEM3)
    .with_show_download_progress(false);
let model = fastembed::TextEmbedding::try_new(options)?;
// ...
model.embed(texts, None)  // lines 74, 137
```

## Recommended Actions

- [ ] **1. Check the exact failing job**: Visit [the CI run](https://github.com/zircote/rlm-rs/actions/runs/23529112132) and identify which specific job(s) failed and the error messages.

- [ ] **2. If `cargo deny` failed**:
  - Identify the specific advisory ID from the log (e.g., `RUSTSEC-YYYY-NNNN`)
  - Add it to `deny.toml` under `[advisories] ignore` with a justification comment
  - Example:
    ```toml
    ignore = [
        # paste is unmaintained but pulled in by fastembed → tokenizers (transitive dep)
        "RUSTSEC-2024-0436",
        # (new crate) advisory - transitive dep via fastembed we can't control
        "RUSTSEC-YYYY-NNNN",
    ]
    ```

- [ ] **3. If compilation failed** (clippy/test/msrv/doc all fail):
  - Check fastembed 5.13.0 release notes and API diff
  - Update `src/embedding/fastembed_impl.rs` to use the new API
  - Common change: `embed()` method signature updated

- [ ] **4. If Windows test failed only**:
  - Check if a new transitive dep uses POSIX-only APIs
  - May need to add conditional compilation or pin the problematic dep

- [ ] **5. Consider adding a `cargo deny` pre-merge check** to the dependabot auto-merge workflow so security advisories are caught before merging

## Prevention Strategies

1. **Run `cargo deny check` locally** before merging dependency bumps: `cargo deny check`
2. **Update the auto-merge workflow** (`dependabot-automerge.yml`) to require all CI checks to pass before auto-merging
3. **Pin fastembed to a patch range** in `Cargo.toml` (e.g., `">=5.13, <5.14"`) for more controlled updates, similar to how `usearch` is pinned to `">=2.23, <2.25"`
4. **Monitor RUSTSEC advisories proactively** via `cargo audit` or the RustSec advisory database for your dependency tree

## AI Team Self-Improvement

Add to your `instructions.md` for AI coding agents:

```
## Dependency Bump Review Checklist

When reviewing or implementing dependency version bumps:
1. Always run `cargo deny check` after bumping any dependency — even minor/patch bumps can introduce new RUSTSEC advisories via transitive deps
2. Check the new version's CHANGELOG for API-breaking changes before bumping
3. For `fastembed`, verify `TextEmbedding::embed()` signature is unchanged (takes `impl IntoIterator(Item=&str)` and `Option(usize)` batch_size)
4. Test on all three CI platforms (Linux/macOS/Windows) mentally — Windows CI uses `--features fastembed-embeddings` only (no usearch)
5. If `cargo deny` fails with a new advisory for a transitive dep, add it to `deny.toml` [advisories] ignore with a justification comment

Historical Context

• Similar past issue: usearch was previously pinned to ">=2.23, <2.25" after v2.24.0 broke Windows compilation (MAP_FAILED POSIX-only constant). The pattern of transitive-dependency platform issues is established in this codebase.
• deny.toml already ignores RUSTSEC-2024-0436 (paste unmaintained, transitive via fastembed → tokenizers) — this same pattern of a new advisory arriving via fastembed's dep tree is the expected failure mode.

AI generated by CI Failure Doctor · history

• expires on Apr 1, 2026, 7:22 AM UTC