From dd495b7f7f78d4696e96b4bbf28fef7fd5be06fe Mon Sep 17 00:00:00 2001 From: AlexanderWagnerDev Date: Sun, 4 Oct 2026 23:14:41 +0200 Subject: [PATCH 1/2] fix(ci): build with --locked CI builds now enforce the committed Cargo.lock instead of resolving newer versions. --- .github/workflows/release.yml | 4 ++-- .github/workflows/tests.yml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 84f624b..ab5494d 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -29,7 +29,7 @@ jobs: - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 - name: Build (release) - run: cargo build --release + run: cargo build --locked --release - name: Run tests run: cargo test --release @@ -57,7 +57,7 @@ jobs: echo "tag=$REF" >> "$GITHUB_OUTPUT" - name: Build release binary - run: cargo build --release + run: cargo build --locked --release - name: Stage install tree run: | diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index 6bb2526..aca16e3 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -30,7 +30,7 @@ jobs: run: cargo clippy --all-targets --features test-support -- -D warnings - name: Build - run: cargo build --verbose + run: cargo build --locked --verbose - name: Run tests run: cargo test --verbose --features test-support -- --test-threads=1 From 3ecf0d7e4a5d9265ac784c6cb1d8d89e39857378 Mon Sep 17 00:00:00 2001 From: AlexanderWagnerDev Date: Sun, 4 Oct 2026 23:20:45 +0200 Subject: [PATCH 2/2] fix(ci): verify Cargo.lock before unlocked cargo commands Run cargo metadata --locked before rust-cache in the release jobs and pass --locked to the first dependency-resolving command in the test job (clippy), so the lock cannot be rewritten before the --locked build check. Addresses Codex review feedback. --- .github/workflows/release.yml | 6 ++++++ .github/workflows/tests.yml | 2 +- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index ab5494d..acdca97 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -26,6 +26,9 @@ jobs: - name: Install Rust uses: dtolnay/rust-toolchain@89b12181fb390509a0842a86cc55eeb8eb928c1d # stable + - name: Verify Cargo.lock is up to date + run: cargo metadata --locked --all-features --format-version 1 > /dev/null + - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 - name: Build (release) @@ -46,6 +49,9 @@ jobs: - name: Install Rust uses: dtolnay/rust-toolchain@89b12181fb390509a0842a86cc55eeb8eb928c1d # stable + - name: Verify Cargo.lock is up to date + run: cargo metadata --locked --all-features --format-version 1 > /dev/null + - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 - name: Resolve version diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index aca16e3..22656c8 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -27,7 +27,7 @@ jobs: run: cargo fmt --check - name: Clippy - run: cargo clippy --all-targets --features test-support -- -D warnings + run: cargo clippy --locked --all-targets --features test-support -- -D warnings - name: Build run: cargo build --locked --verbose