ci: use --locked while installing cargo-generate

[kayagokalp]

Description

closes #4577.

Because of an upstream issue in cargo-generate, which can be seen from cargo-generate/cargo-generate#942, our CI is blocked. Until the fix lands we need the --locked flag added to install step.

[Braqzen]

Coolio, afaik this will throw an error to say that cargo update needs to be run because upstream dependencies have changed

[kayagokalp]

Coolio, afaik this will throw an error to say that cargo update needs to be run because upstream dependencies have changed

Thanks for the ✅, we will remove the --locked once upstream issue is fixed

[mitchmindtree]

Good catch!

I'd recommend keeping the --locked flag going forward - all it does is make sure that the existing Cargo.lock file in our workspace is valid, which helps to make sure that we can build entirely from existing, pinned dependencies in a deterministic manner.

Without --locked, cargo will sometimes automatically update dependencies if e.g. a new dependency was added, but the lock file was not updated. This is a problem as it might end up pulling in a different version each time it gets run, leading to non-determinism in our CI checks.

I wonder if there's a way we can specify some global cargo configuration so that it uses --locked by default in our CI so that we don't have to remember to add --locked to just about every cargo invocation 🤔

[kayagokalp]

Good catch!

I'd recommend keeping the --locked flag going forward - all it does is make sure that the existing Cargo.lock file in our workspace is valid, which helps to make sure that we can build entirely from existing, pinned dependencies in a deterministic manner.

Without --locked, cargo will sometimes automatically update dependencies if e.g. a new dependency was added, but the lock file was not updated. This is a problem as it might end up pulling in a different version each time it gets run, leading to non-determinism in our CI checks.

I wonder if there's a way we can specify some global cargo configuration so that it uses --locked by default in our CI so that we don't have to remember to add --locked to just about every cargo invocation 🤔

That would be superb, quick search yielded following issues:

1. Cargo config option to default to locked/frozen rust-lang/cargo#8207
2. Cargo config option to default to locked/frozen rust-lang/cargo#8207

Seems like we don't have a way to do that, but will keep an eye out for a solution we can use 👍