Symptom
Four workflows and 13 jobs die at Set up job, before checkout, on every push to main. Exact runner error (run 31170993296, job 92842543720):
##[error]Lockfile pin 4cda84d5c5c54efe2404f9d843567869ab1699d4 for
`dtolnay/rust-toolchain` does not match ref `stable`.
Ensure the pinned commit exists on the expected branch or tag
Casualties on d75cb0e:
| Workflow |
Failing jobs |
| Rust CI |
Check, Format, Test, Clippy, Cargo check + clippy + fmt |
| Tests |
E2E — Rust CLI Scan, criterion + baseline gate, stress-test, Integration Tests |
| CI |
Rust Format, Rust Check & Clippy |
| Docs & Code Quality |
Build AsciiDoc |
It also blocks all four open Dependabot PRs (#678, #679, #680, #682) — they show the identical Set up job failure set.
Root cause
.github/workflows/actions.lock pins dtolnay/rust-toolchain@stable to a SHA. @stable is a moving ref: dtolnay retags it on every Rust release, so the pinned commit stops matching and the lockfile check rejects the workflow.
Why "just re-pin" is the wrong fix
Re-pinning restores green until the next Rust release, then breaks again — indefinitely. dtolnay/rust-toolchain is additionally a special case: the ref is the toolchain selector, so pinning it by SHA also destroys its semantics (@stable means "install stable"; a SHA means "install whatever that commit's default was").
The fix is to stop lockfile-pinning moving refs: either exclude dtolnay/rust-toolchain from the lockfile and let @stable resolve, or pin a genuinely immutable tag.
Leverage
One line. Unblocks 4 workflows, 13 jobs and 4 PRs simultaneously — the highest fix-effort-to-impact ratio currently in the repo.
Do this together with #
Two jobs in the affected set are fake gates that will turn green while testing nothing the moment this is fixed. Fixing this alone converts a visible failure into invisible non-coverage.
Evidence and full context: docs/DEBT-REGISTER.md (CI-1).
Symptom
Four workflows and 13 jobs die at
Set up job, before checkout, on every push tomain. Exact runner error (run31170993296, job92842543720):Casualties on
d75cb0e:It also blocks all four open Dependabot PRs (#678, #679, #680, #682) — they show the identical
Set up jobfailure set.Root cause
.github/workflows/actions.lockpinsdtolnay/rust-toolchain@stableto a SHA.@stableis a moving ref: dtolnay retags it on every Rust release, so the pinned commit stops matching and the lockfile check rejects the workflow.Why "just re-pin" is the wrong fix
Re-pinning restores green until the next Rust release, then breaks again — indefinitely.
dtolnay/rust-toolchainis additionally a special case: the ref is the toolchain selector, so pinning it by SHA also destroys its semantics (@stablemeans "install stable"; a SHA means "install whatever that commit's default was").The fix is to stop lockfile-pinning moving refs: either exclude
dtolnay/rust-toolchainfrom the lockfile and let@stableresolve, or pin a genuinely immutable tag.Leverage
One line. Unblocks 4 workflows, 13 jobs and 4 PRs simultaneously — the highest fix-effort-to-impact ratio currently in the repo.
Do this together with #
Two jobs in the affected set are fake gates that will turn green while testing nothing the moment this is fixed. Fixing this alone converts a visible failure into invisible non-coverage.
Evidence and full context:
docs/DEBT-REGISTER.md(CI-1).