fix(ci): make MSRV real — raise to Rust 1.88 and actually test on it

.github/workflows/ci.yml

@@ -59,13 +59,17 @@ jobs:
         run: RUSTDOCFLAGS="-D warnings" cargo doc --manifest-path core/Cargo.toml --no-deps --locked
 
   msrv:
-    name: MSRV (1.75)
+    name: MSRV (1.88)
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
 
-      - name: Install Rust 1.75
-        uses: dtolnay/rust-toolchain@1.75
+      # Pin the toolchain through the `toolchain` input, not the action ref: Dependabot
+      # treats `@1.xx` refs as action versions and "upgrades" them.
+      - name: Install Rust 1.88
+        uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: "1.88"
 
       - name: Cache cargo registry
         uses: actions/cache@v6
@@ -78,8 +82,10 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-cargo-msrv-
 
-      - name: Build on MSRV
-        run: cargo build --manifest-path core/Cargo.toml
+      # `+1.88` overrides rust-toolchain.toml (which pins stable); without it this job
+      # silently builds on stable.
+      - name: Test on MSRV
+        run: cargo +1.88 test --manifest-path core/Cargo.toml --locked
 
   deny:
     name: Dependency audit (cargo deny)

CHANGELOG.md

@@ -17,7 +17,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - `command_words` CEL variable for matching subcommands without false positives from paths
 - `reset = "always"` mode blocks unconditionally on every hook invocation
 - `#[non_exhaustive]` on `HookResponse` and `Reset` for semver-safe extensibility
-- MSRV set to Rust 1.75 in `Cargo.toml`
+- MSRV set to Rust 1.88 in `Cargo.toml`, the oldest toolchain that builds the locked dependencies (`regress` uses let-chains; `toml` 1.1 and `serde_spanned` need edition 2024); the CI MSRV job now really builds and tests on it
 - Windows `x86_64-pc-windows-msvc` binary in the release matrix
 - Module-level rustdoc (`//!`) and public-API doc comments across all modules
 - Append-only JSONL audit log at `.steplock/audit.log`

README.md

@@ -2,7 +2,7 @@
 
 [![CI](https://github.com/polyhook/steplock/actions/workflows/ci.yml/badge.svg)](https://github.com/polyhook/steplock/actions/workflows/ci.yml)
 [![Crates.io](https://img.shields.io/crates/v/steplock.svg)](https://crates.io/crates/steplock)
-[![MSRV](https://img.shields.io/badge/rustc-1.75+-orange.svg)](https://www.rust-lang.org)
+[![MSRV](https://img.shields.io/badge/rustc-1.88+-orange.svg)](https://www.rust-lang.org)
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
 
 **Stateful quality gates for AI coding agent actions.**

core/Cargo.toml

@@ -2,7 +2,7 @@
 name = "steplock"
 version = "0.1.0"
 edition = "2021"
-rust-version = "1.75"
+rust-version = "1.88"
 description = "Stateful quality gate logic for steplock"
 license = "MIT"
 repository = "https://github.com/polyhook/steplock"
@@ -87,6 +87,7 @@ single_match_else = "deny"
 manual_let_else = "deny"
 items_after_statements = "deny"
 needless_pass_by_value = "deny"
+trivially_copy_pass_by_ref = "deny"
 
 [dependencies]
 cel-interpreter = "0.10"