Merge branch 'metal-icb-multi-draw-indirect' into metal-icb-multi-draw-indirect-count

Rebase the count lowering onto the pooled ICB base: count draws take
their ICB from the per-adapter pool, skip the reset pass (they execute a
GPU-clamped range, so unexecuted slots are never read), and inherit the
per-family optimize gating.

Author: matthargett

.deny.toml

@@ -27,10 +27,6 @@ allow-wildcard-paths = true
 
 [advisories]
 ignore = [
-    # `paste` crate is no longer maintained https://rustsec.org/advisories/RUSTSEC-2024-0436
-    # It's a transitive dependency of `wgpu-core` via `macro_rules_attribute`.
-    # https://github.com/gfx-rs/wgpu/issues/7873
-    "RUSTSEC-2024-0436",
     # `bincode` is no longer maintained https://rustsec.org/advisories/RUSTSEC-2025-0141
     # We only use it directly for tests and tools. It is also used indirectly via deno.
     "RUSTSEC-2025-0141",

.github/ISSUE_TEMPLATE/bug_report.md

@@ -6,7 +6,7 @@ labels: bug
 assignees: ""
 ---
 
-<!-- Thank you for filing this! Please read the [debugging tips](https://github.com/gfx-rs/wgpu/wiki/Debugging-wgpu-Applications).
+<!-- Thank you for filing this! Please read the [debugging tips](https://docs.rs/wgpu/latest/wgpu/documentation/debugging/debugging_applications/index.html).
 That may let you investigate on your own, or provide additional information that helps us to assist.-->
 
 **Description**

.github/actions/install-agility-sdk/action.yml

@@ -4,7 +4,12 @@ runs:
   using: "composite"
   steps:
     - shell: bash
-      run: |
+      # NOTE: We ignore the `github-env` lint because we trust:
+      #
+      # - Our `install-agility-sdk` task's output
+      # - Otherwise, `WGPU_DX12_AGILITY_SDK_REQUIRE` is a fixed environment variable that is easy
+      #   to audit.
+      run: | # zizmor: ignore[github-env]
         set -e
 
         cargo xtask install-agility-sdk >> "$GITHUB_ENV"

.github/actions/install-dxc/action.yml

@@ -4,7 +4,11 @@ runs:
   using: "composite"
   steps:
     - shell: bash
-      run: |
+      # NOTE: We ignore the `github-env` lint because we trust:
+      #
+      # - The `cygpath` tool
+      # - The contents of the DXC release we use.
+      run: | # zizmor: ignore[github-env]
         set -e
 
         export DXC_RELEASE="v1.9.2602.24"

.github/actions/install-mesa/action.yml

@@ -20,7 +20,12 @@ runs:
       env:
         MESA_VERSION: ${{ inputs.version }}
         CI_BINARY_BUILD: ${{ inputs.ci-binary-build }}
-      run: |
+      # NOTE: We ignore `github-env` because we trust:
+      #
+      # - The `cygpath` tool
+      # - The `$PWD` variable
+      # - The contents of the Mesa archive we download here, which we control.
+      run: | # zizmor: ignore[github-env]
         set -e
 
         curl -L --retry 5 https://github.com/gfx-rs/ci-build/releases/download/$CI_BINARY_BUILD/mesa-$MESA_VERSION-linux-x86_64.tar.xz -o mesa.tar.xz
@@ -51,14 +56,20 @@ runs:
       env:
         MESA_VERSION: ${{ inputs.version }}
         CI_BINARY_BUILD: ${{ inputs.ci-binary-build }}
-      run: |
+        INPUTS_TARGET_DIR: ${{ inputs.target-dir }}
+      # NOTE: We ignore `github-env` because we trust:
+      #
+      # - The `cygpath` tool
+      # - The `$PWD` variable
+      # - The contents of the Mesa archive we download here.
+      run: | # zizmor: ignore[github-env]
         set -e
 
         curl.exe -L --retry 5 https://github.com/pal1000/mesa-dist-win/releases/download/$MESA_VERSION/mesa3d-$MESA_VERSION-release-msvc.7z -o mesa.7z
         7z.exe e mesa.7z -omesa x64/{opengl32.dll,libgallium_wgl.dll,libglapi.dll,vulkan_lvp.dll,lvp_icd.x86_64.json}
 
-        cp -v mesa/* ${{ inputs.target-dir }}/
-        cp -v mesa/* ${{ inputs.target-dir }}/deps
+        cp -v mesa/* ${INPUTS_TARGET_DIR}/
+        cp -v mesa/* ${INPUTS_TARGET_DIR}/deps
 
         # We need to use cygpath to convert PWD to a windows path as we're using bash.
         echo "VK_DRIVER_FILES=`cygpath --windows $PWD/mesa/lvp_icd.x86_64.json`" >> "$GITHUB_ENV"

.github/actions/install-vulkan-sdk/action.yml

@@ -3,9 +3,9 @@ description: "Install Vulkan SDK"
 inputs:
   # Sourced from https://vulkan.lunarg.com/sdk/home#linux
   version:
-    default: "1.4.328"
+    default: "1.4.357"
   full-version:
-    default: "1.4.328.1"
+    default: "1.4.357.0"
 runs:
   using: "composite"
   steps:
@@ -15,14 +15,17 @@ runs:
       env:
         VULKAN_SDK_VERSION: ${{ inputs.version }}
         VULKAN_FULL_SDK_VERSION: ${{ inputs.full-version }}
-      run: |
+      # NOTE: We ignore the `github-env` lint because we trust:
+      #
+      # - The contents of the Vulkan SDK we are downloading.
+      run: | # zizmor: ignore[github-env]
         set -e
 
-        curl -L --retry 5 https://sdk.lunarg.com/sdk/download/${{ env.VULKAN_FULL_SDK_VERSION }}/linux/vulkansdk-linux-x86_64-${{ env.VULKAN_FULL_SDK_VERSION }}.tar.xz -o vulkan-sdk.tar.xz
+        curl -L --retry 5 https://sdk.lunarg.com/sdk/download/${VULKAN_FULL_SDK_VERSION}/linux/vulkansdk-linux-x86_64-${VULKAN_FULL_SDK_VERSION}.tar.xz -o vulkan-sdk.tar.xz
         mkdir vulkan-sdk
         tar xpf vulkan-sdk.tar.xz -C vulkan-sdk
 
-        mv ./vulkan-sdk/${{ env.VULKAN_FULL_SDK_VERSION }} $HOME/VulkanSDK
+        mv ./vulkan-sdk/${VULKAN_FULL_SDK_VERSION} $HOME/VulkanSDK
 
         echo "$HOME/VulkanSDK/x86_64/bin" >> "$GITHUB_PATH"
         echo "LD_LIBRARY_PATH=$HOME/VulkanSDK/x86_64/lib${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}" >> "$GITHUB_ENV"
@@ -34,28 +37,34 @@ runs:
       env:
         VULKAN_SDK_VERSION: ${{ inputs.version }}
         VULKAN_FULL_SDK_VERSION: ${{ inputs.full-version }}
-      run: |
+      # NOTE: We ignore the `github-env` lint because we trust:
+      #
+      # - The contents of the Vulkan SDK we are downloading.
+      run: | # zizmor: ignore[github-env]
         set -e
 
-        curl.exe -L --retry 5 https://sdk.lunarg.com/sdk/download/${{ env.VULKAN_FULL_SDK_VERSION }}/windows/vulkansdk-windows-X64-${{ env.VULKAN_FULL_SDK_VERSION }}.exe -o vulkan-sdk-installer.exe
+        curl.exe -L --retry 5 https://sdk.lunarg.com/sdk/download/${VULKAN_FULL_SDK_VERSION}/windows/vulkansdk-windows-X64-${VULKAN_FULL_SDK_VERSION}.exe -o vulkan-sdk-installer.exe
 
         ./vulkan-sdk-installer.exe --accept-licenses --default-answer --confirm-command install
 
-        echo "C:/VulkanSDK/${{ env.VULKAN_FULL_SDK_VERSION }}/Bin" >> "$GITHUB_PATH"
+        echo "C:/VulkanSDK/${VULKAN_FULL_SDK_VERSION}/Bin" >> "$GITHUB_PATH"
 
     - name: (Mac) Install Vulkan SDK
       if: runner.os == 'macOS'
       shell: bash
       env:
         VULKAN_SDK_VERSION: ${{ inputs.version }}
         VULKAN_FULL_SDK_VERSION: ${{ inputs.full-version }}
-      run: |
+      # NOTE: We ignore the `github-env` lint because we trust:
+      #
+      # - The contents of the Vulkan SDK we are downloading.
+      run: | # zizmor: ignore[github-env]
         set -e
 
-        curl -L --retry 5 https://sdk.lunarg.com/sdk/download/${{ env.VULKAN_FULL_SDK_VERSION }}/mac/vulkansdk-macos-${{ env.VULKAN_FULL_SDK_VERSION }}.zip -o vulkan-sdk.zip
+        curl -L --retry 5 https://sdk.lunarg.com/sdk/download/${VULKAN_FULL_SDK_VERSION}/mac/vulkansdk-macos-${VULKAN_FULL_SDK_VERSION}.zip -o vulkan-sdk.zip
         unzip vulkan-sdk.zip -d vulkan-sdk
 
         ls -l vulkan-sdk
-        sudo ./vulkan-sdk/vulkansdk-macOS-${{ env.VULKAN_FULL_SDK_VERSION }}.app/Contents/MacOS/vulkansdk-macOS-${{ env.VULKAN_FULL_SDK_VERSION }} --root "$HOME/VulkanSDK" --accept-licenses --default-answer --confirm-command install
+        sudo ./vulkan-sdk/vulkansdk-macOS-${VULKAN_FULL_SDK_VERSION}.app/Contents/MacOS/vulkansdk-macOS-${VULKAN_FULL_SDK_VERSION} --root "$HOME/VulkanSDK" --accept-licenses --default-answer --confirm-command install
 
         echo "$HOME/VulkanSDK/macOS/bin" >> "$GITHUB_PATH"

.github/actions/install-warp/action.yml

@@ -8,7 +8,9 @@ runs:
   using: "composite"
   steps:
     - shell: bash
+      env:
+        INPUTS_TARGET_DIR: ${{ inputs.target-dir }}
       run: |
         set -e
 
-        cargo xtask install-warp --target-dir ${{ inputs.target-dir }}
+        cargo xtask install-warp --target-dir ${INPUTS_TARGET_DIR}

.github/pull_request_template.md

@@ -10,10 +10,11 @@ approved. Don't use draft PR status to indicate this._
 _Describe what problem this is solving, and how it's solved._
 
 **Testing**
-_Explain how this change is tested._
+_Explain what you have done to ensure this change is adequately tested
+(e.g. adding test cases, running tests on an unusual platform, or
+manually checking visual results)._
 
 **Squash or Rebase?**
-
 _If your pull request contains multiple commits, please indicate whether
 they need to be squashed into a single commit before they're merged,
 or if they're ready to rebase onto `trunk` as they stand. In the
@@ -32,10 +33,10 @@ person(s) who reviewed your changes. This will make sure it gets re-added to the
 <!-- Note that checking all the boxes is not necessary to open a PR. -->
 
 - [ ] I self-reviewed and fully understand this PR.
-- [ ] WebGPU implementations built with `wgpu` may be affected behaviorally.
-- [ ] Validation and feature gates are in place to confine behavioral changes.
-- [ ] Tests demonstrate the validation and altered logic works. <!-- See `docs/testing.md` -->
 - [ ] `CHANGELOG.md` entries for the user-facing effects of this change are present. <!-- See instructions at the top of `CHANGELOG.md`. -->
 - [ ] The PR is minimal, and doesn't make sense to land as multiple PRs.
 - [ ] Commits are logically scoped and individually reviewable.
 - [ ] The PR description has enough context to understand the motivation and solution implemented.
+- [ ] (If applicable) WebGPU implementations built with `wgpu` may be affected behaviorally.
+- [ ] (If applicable) Validation and feature gates are in place to confine behavioral changes.
+- [ ] (If applicable) Tests demonstrate the validation and altered logic works. <!-- See `docs/testing.md` -->

.github/workflows/changelog.yml

@@ -38,13 +38,18 @@ jobs:
     name: Check changelog for errors
     runs-on: ubuntu-latest
 
+    permissions: {}
+
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       # NOTE: Keep label name(s) in sync. with `xtask`'s implementation.
       - name: Run `cargo xtask changelog …`
+        env:
+          GITHUB_EVENT_PULL_REQUEST_BASE_REF: ${{ github.event.pull_request.base.ref }}
         run: |
-          cargo xtask changelog "origin/${{ github.event.pull_request.base.ref }}" ${{ contains(github.event.pull_request.labels.*.name, 'changelog: released entry changed') && '--allow-released-changes' || ''  }}
+          cargo xtask changelog "origin/${GITHUB_EVENT_PULL_REQUEST_BASE_REF}" ${{ contains(github.event.pull_request.labels.*.name, 'changelog: released entry changed') && '--allow-released-changes' || ''  }}