Skip to content

Export the cargo-binstall version pin#271

Merged
leynos merged 8 commits into
mainfrom
feat/export-binstall-pin
May 24, 2026
Merged

Export the cargo-binstall version pin#271
leynos merged 8 commits into
mainfrom
feat/export-binstall-pin

Conversation

@leynos
Copy link
Copy Markdown
Owner

@leynos leynos commented May 21, 2026

Summary

This branch exports the BINSTALL_VERSION variable in the setup-rust action so the cargo-binstall installer subprocess receives the pinned v1.16.6 release instead of falling back to releases/latest. It also adds a smoke assertion that the installed binary reports 1.16.6, proving the action did not install whatever latest resolves to at run time.

No linked issue, roadmap task, or execplan was found for this branch.

Review walkthrough

Validation

  • make check-fmt: passed.
  • make typecheck: passed.
  • make lint: passed.
  • make test: passed with 719 passed, 93 skipped.
  • Isolated Linux x86_64 cargo-binstall smoke: passed; the installer requested https://github.com/cargo-bins/cargo-binstall/releases/download/v1.16.6/cargo-binstall-x86_64-unknown-linux-musl.tgz and the installed binary reported 1.16.6.

Notes

The requested cargo binstall --version | grep -q "1.16.6" assertion was adjusted to cargo-binstall -V | grep -q "1.16.6" because cargo-binstall v1.16.6 treats --version as a package-selection option requiring a value. The -V flag is the supported binary-version output for this pinned release.

Summary by Sourcery

Pin the cargo-binstall installer to a specific version in the setup-rust GitHub Action and verify that the installed binary matches the pinned version.

Enhancements:

  • Export the BINSTALL_VERSION environment variable so the cargo-binstall installer script reliably uses the pinned v1.16.6 release.
  • Add a smoke check to assert that the installed cargo-binstall binary reports version 1.16.6.

Export `BINSTALL_VERSION` so the installer subprocess uses the pinned
`v1.16.6` release instead of falling back to the latest release URL.
Also assert the installed binary reports `1.16.6`.
@coderabbitai
Copy link
Copy Markdown
Contributor

coderabbitai Bot commented May 21, 2026

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 55b8413a-ed48-4cde-9ed0-fbc97de5320c

📥 Commits

Reviewing files that changed from the base of the PR and between 76ae18c and 5ec909e.

📒 Files selected for processing (1)
  • .github/actions/setup-rust/tests/test_setup_rust_manifest.py

Walkthrough

Export the BINSTALL_VERSION environment variable in the inline installer and add a post‑install verification that runs cargo-binstall -V and fails unless the output contains the pinned release string.

Changes

Cargo-binstall version export and verification

Layer / File(s) Summary
Installer export and runtime verification
.github/actions/setup-rust/action.yml
Export BINSTALL_VERSION so the installer child shell sees it; after installation run cargo-binstall -V and exit with error unless output contains 1.16.6.
Manifest tests for installer script
.github/actions/setup-rust/tests/test_setup_rust_manifest.py
Add helpers to load composite-action steps and step conditions, extract the "Install cargo-binstall" run script, and add tests asserting the export BINSTALL_VERSION="v1.16.6" pin and a verification grep for 1.16.6. Behavioural tests run the fragment with stubbed curl, sha256sum, and cargo-binstall to assert propagation, download URL, verified-version logging, and failure on mismatch.
Documentation about pinning and export
.github/actions/setup-rust/README.md, docs/developers-guide.md
Require exporting BINSTALL_VERSION for the child installer process, describe computing the installer SHA‑256 by substituting the desired tag, and document the post‑install cargo-binstall -V runtime check.

Sequence Diagram

sequenceDiagram
  participant ActionYML as action.yml
  participant Installer as installer.sh
  participant Binary as cargo-binstall
  ActionYML->>Installer: export BINSTALL_VERSION="v1.16.6"
  Installer->>Binary: download & install release tagged by BINSTALL_VERSION
  Binary->>ActionYML: cargo-binstall -V (version string)
  ActionYML->>ActionYML: verify -V contains "1.16.6" or exit non‑zero
Loading
  • Suggested reviewers:
    • codescene-delta-analysis

Poem

Export the pin, let shells inherit,
Run the check and fail or quit,
Stamp the installer with the tag,
Hear the binary speak its tag,
Trust the echo of 1.16.6. 🦀

🚥 Pre-merge checks | ✅ 20
✅ Passed checks (20 passed)
Check name Status Explanation
Title check ✅ Passed The title accurately describes the primary change: exporting the BINSTALL_VERSION variable to pin the cargo-binstall version in the setup-rust action.
Description check ✅ Passed The description is well-structured and directly related to the changeset, covering the cargo-binstall version pinning, verification assertions, and validation results.
Docstring Coverage ✅ Passed Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Testing (Overall) ✅ Passed Tests cover cargo-binstall pinning with static assertions and runtime stubs. Tests fail if export keyword, version, or verification logic were removed or incorrect.
User-Facing Documentation ✅ Passed User documentation provided in setup-rust/README.md per repository standards; explains BINSTALL_VERSION export and cargo-binstall pinning for action consumers.
Developer Documentation ✅ Passed New section added to developers-guide.md documenting cargo-binstall version pinning, BINSTALL_VERSION export requirement, and SHA-256 verification approach with maintenance guidance.
Module-Level Documentation ✅ Passed The Python module test_setup_rust_manifest.py has a module-level docstring that explains the module's purpose, utility, function, and relationship to the setup-rust component.
Testing (Unit And Behavioural) ✅ Passed Unit tests verify edge cases and error paths with assertions. Behavioural tests exercise functional boundaries via subprocess execution with deterministic stubs and version injection.
Testing (Property / Proof) ✅ Passed PR introduces fixed pinned constants (version, checksum) with deterministic verification logic, not variable-input invariants requiring property-based or formal proof testing.
Testing (Compile-Time / Ui) ✅ Passed PR adds integration tests for shell script execution with direct assertions on exit codes and stdout/stderr, not compile-time or UI-adjacent output that requires snapshot testing.
Unit Architecture ✅ Passed Query helpers are pure; commands isolate side-effects in parameters. Fallibility explicit. Dependencies injected. Single responsibility maintained.
Domain Architecture ✅ Passed PR modifies only GitHub Actions workflow infrastructure and tests; contains no domain logic or architectural boundaries to assess against the domain architecture check.
Observability ✅ Passed PR provides adequate observability: logs at decision points include contextual information (SHA256 hash, actual version), comprehensive tests validate all failure paths.
Security And Privacy ✅ Passed PR exports version v1.16.6 with SHA256 verification, HTTPS enforcement, and version validation—no secrets, credentials, injection risks, or privacy exposure detected.
Performance And Resource Use ✅ Passed Changes exhibit bounded resource use: action.yml executes sequential operations once; tests load fixed 197-line manifest; no unbounded loops, allocations, or repeated I/O.
Concurrency And State ✅ Passed GitHub Actions shell scripts with no concurrency, async execution, or shared mutable state. Environment variables exported to child shells correctly; tests use isolated temporary directories.
Architectural Complexity And Maintainability ✅ Passed Test helpers are reused, acyclic, and justified. No speculative abstraction or circular dependencies. Proportional complexity with minimal production changes.
Rust Compiler Lint Integrity ✅ Passed PR contains no Rust source code changes; check applies only to Rust compiler directives and lint suppressions, which are absent here.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch feat/export-binstall-pin

Comment @coderabbitai help to get the list of available commands and usage tips.

@sourcery-ai
Copy link
Copy Markdown
Contributor

sourcery-ai Bot commented May 21, 2026

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

Exports the pinned cargo-binstall version in the setup-rust composite GitHub Action so the installer script consumes the pinned version, and adds a smoke assertion that validates the installed cargo-binstall binary reports version 1.16.6.

Sequence diagram for pinned cargo-binstall installation and smoke check

sequenceDiagram
    participant GitHubRunner
    participant setup_rust_action
    participant cargo_binstall_installer
    participant cargo_binstall_binary

    GitHubRunner->>setup_rust_action: run setup-rust
    setup_rust_action->>setup_rust_action: export BINSTALL_VERSION=v1.16.6
    setup_rust_action->>cargo_binstall_installer: bash INSTALLER_PATH (uses BINSTALL_VERSION)
    cargo_binstall_installer-->>setup_rust_action: install cargo-binstall v1.16.6
    setup_rust_action->>cargo_binstall_binary: cargo-binstall -V
    cargo_binstall_binary-->>setup_rust_action: 1.16.6
    setup_rust_action->>setup_rust_action: grep -q "1.16.6" (smoke assertion)
Loading

File-Level Changes

Change Details Files
Ensure cargo-binstall installer uses the pinned v1.16.6 release instead of defaulting to latest.
  • Change BINSTALL_VERSION assignment to be exported so it is visible to the installer subprocess.
  • Keep the existing BINSTALL_SHA256 and INSTALLER_URL composition that rely on BINSTALL_VERSION unchanged.
.github/actions/setup-rust/action.yml
Add a smoke test assertion that verifies the installed cargo-binstall binary version matches the pin.
  • Run cargo-binstall with the -V flag after installation to print its version.
  • Pipe the version output to grep to assert it contains 1.16.6, causing the step to fail if the expected version is not installed.
  • Use -V instead of --version to match the behavior of cargo-binstall v1.16.6, where --version is treated as an option requiring an argument.
.github/actions/setup-rust/action.yml

Tips and commands

Interacting with Sourcery

  • Trigger a new review: Comment @sourcery-ai review on the pull request.
  • Continue discussions: Reply directly to Sourcery's review comments.
  • Generate a GitHub issue from a review comment: Ask Sourcery to create an
    issue from a review comment by replying to it. You can also reply to a
    review comment with @sourcery-ai issue to create an issue from it.
  • Generate a pull request title: Write @sourcery-ai anywhere in the pull
    request title to generate a title at any time. You can also comment
    @sourcery-ai title on the pull request to (re-)generate the title at any time.
  • Generate a pull request summary: Write @sourcery-ai summary anywhere in
    the pull request body to generate a PR summary at any time exactly where you
    want it. You can also comment @sourcery-ai summary on the pull request to
    (re-)generate the summary at any time.
  • Generate reviewer's guide: Comment @sourcery-ai guide on the pull
    request to (re-)generate the reviewer's guide at any time.
  • Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
    pull request to resolve all Sourcery comments. Useful if you've already
    addressed all the comments and don't want to see them anymore.
  • Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
    request to dismiss all existing Sourcery reviews. Especially useful if you
    want to start fresh with a new review - don't forget to comment
    @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

  • Enable or disable review features such as the Sourcery-generated pull request
    summary, the reviewer's guide, and others.
  • Change the review language.
  • Add, remove or edit custom review instructions.
  • Adjust other review settings.

Getting Help

codescene-delta-analysis[bot]

This comment was marked as outdated.

@leynos leynos marked this pull request as ready for review May 21, 2026 18:45
Copy link
Copy Markdown
Contributor

@sourcery-ai sourcery-ai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey - I've reviewed your changes and they look great!


Sourcery is free for open source - if you like our reviews please consider sharing them ✨
Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.

Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/actions/setup-rust/action.yml:
- Line 93: The version-check pipeline currently runs "cargo-binstall -V | grep
-q \"1.16.6\"" without an explicit failure message; modify the check to wrap it
in an if-failed block so that when the version doesn't match you print a clear
error like "cargo-binstall version verification failed: expected 1.16.6", output
the actual "cargo-binstall -V" to stderr, and exit 1; update the command around
the cargo-binstall -V invocation in action.yml accordingly to mirror the
checksum validation pattern.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 87d6b3cd-7b76-4248-aa44-aafeb9cbe754

📥 Commits

Reviewing files that changed from the base of the PR and between e4c6b0e and a02c469.

📒 Files selected for processing (1)
  • .github/actions/setup-rust/action.yml

Comment thread .github/actions/setup-rust/action.yml Outdated
Wrap the pinned cargo-binstall version check in an explicit failure block
so CI logs show the expected version and the actual installed binary
version before exiting.
codescene-delta-analysis[bot]

This comment was marked as outdated.

Explain why `BINSTALL_VERSION` must be exported for the setup-rust
installer subprocess and record the cargo-binstall version pinning strategy
in the developer guide.
codescene-delta-analysis[bot]

This comment was marked as outdated.

Emit the verified cargo-binstall version on the success path and add
manifest tests that lock in the exported version pin and installed-version
assertion.
codescene-delta-analysis[bot]

This comment was marked as outdated.

Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/actions/setup-rust/tests/test_setup_rust_manifest.py:
- Around line 17-24: The helper _install_binstall_run_script currently uses
next(...) without a default so it raises StopIteration with no context if the
"Install cargo-binstall" step is missing; update the function (referencing
_install_binstall_run_script and _load_steps) to either call next(..., None) and
assert the result is not None with a clear message like "manifest missing
'Install cargo-binstall' step", or catch StopIteration and raise an
AssertionError (or ValueError) with that explicit message before proceeding to
extract run; keep the existing type check for run_script afterwards.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 5f24b737-5b10-40ea-9d8f-1681753ea17e

📥 Commits

Reviewing files that changed from the base of the PR and between 1a174a5 and e8f2054.

📒 Files selected for processing (2)
  • .github/actions/setup-rust/action.yml
  • .github/actions/setup-rust/tests/test_setup_rust_manifest.py

Comment thread .github/actions/setup-rust/tests/test_setup_rust_manifest.py Outdated
@leynos
Copy link
Copy Markdown
Owner Author

leynos commented May 24, 2026

@coderabbitai Please suggest a fix for this issue and supply a prompt for an AI coding agent to enable it to apply the fix. Include the file and symbol names indicated in the issue at the head of your response. Ensure that this is validated against the current version of the codegraph.

If further refinement to address this finding would be deleterious, please supply a clear explanatory one to two paragraph markdown message I can paste into the CodeScene web ui's diagnostic suppression function so this diagnostic can be silenced.

.github/actions/setup-rust/tests/test_setup_rust_manifest.py

Comment on file

    return manifest["runs"]["steps"]


def _install_binstall_run_script() -> str:

❌ New issue: Code Duplication
The module contains 2 functions with similar structure: test_install_postgres_deps_is_linux_only,test_install_postgres_deps_windows_uses_choco

@coderabbitai

This comment was marked as resolved.

Add a helper for retrieving step conditions and use it in the Postgres
setup-rust manifest tests to remove duplicated step lookup logic.
codescene-delta-analysis[bot]

This comment was marked as outdated.

Make setup-rust manifest helper failures explicit when expected steps or
fields are missing, and tighten cargo-binstall pin checks to match complete
run-script lines.
codescene-delta-analysis[bot]

This comment was marked as outdated.

Add deterministic shell-fragment tests for the setup-rust cargo-binstall
installer block so the exported version pin, pinned download URL, success
logging, and mismatch failure path are covered without network access.
codescene-delta-analysis[bot]

This comment was marked as outdated.

coderabbitai[bot]

This comment was marked as resolved.

Add focused tests for missing setup-rust manifest steps and missing
helper fields so assertion branches report the expected context.
@leynos
Copy link
Copy Markdown
Owner Author

leynos commented May 24, 2026

@coderabbitai Have the following now been resolved?

.github/actions/setup-rust/tests/test_setup_rust_manifest.py (1)

27-48: 🛠️ Refactor suggestion | 🟠 Major | ⚡ Quick win
Add tests for the error paths in the helper functions.
The helpers _get_step, _get_step_condition, and _install_binstall_run_script include assertions for missing or invalid steps, but these branches are not exercised by the current tests. Add test cases that verify the error messages when:

  • A requested step name does not exist in the manifest
  • A step's if field is missing or not a string
  • A step's run field is missing or not a string
    This ensures the defensive assertions are correct and improves branch coverage toward the 80% guideline threshold. As per coding guidelines, maintain at least 80% branch coverage for unit tests.
🧪 Proposed test additions
+def test_get_step_fails_on_missing_step() -> None:
+    """_get_step should raise AssertionError with a clear message for missing steps."""
+    with pytest.raises(AssertionError, match="Missing setup-rust step: Nonexistent Step"):
+        _get_step("Nonexistent Step")
+
+
+def test_get_step_condition_fails_on_missing_condition() -> None:
+    """_get_step_condition should fail clearly when a step has no 'if' field."""
+    # This would require either mocking _get_step or using a step known to lack 'if'
+    # Inspect action.yml to find a step without an 'if' condition, or mock
+    with pytest.raises(AssertionError, match="Step has no string condition"):
+        _get_step_condition("Install Rust")  # Replace with actual unconditional step
+
+
+def test_install_binstall_run_script_fails_on_missing_run() -> None:
+    """_install_binstall_run_script should fail clearly if 'run' is absent."""
+    # This would require mocking or temporarily modifying the helper
+    # Alternatively, accept that this is implicitly tested by action.yml structure
+    pass  # Consider whether this test adds value given the manifest structure
🤖 Detailed instructions

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/actions/setup-rust/tests/test_setup_rust_manifest.py around lines 27

  • 48, Add unit tests that exercise the assertion branches by monkeypatching
    _load_steps to return controlled step lists: 1) for _get_step, return a list
    without the queried name and assert AssertionError with message "Missing
    setup-rust step: " when calling _get_step("Nonexistent Step"); 2) for
    _get_step_condition, return a step with the requested name but with no 'if' or a
    non-string 'if' and assert AssertionError matching "Step has no string
    condition" when calling _get_step_condition(""); 3) for
    _install_binstall_run_script, return a step named "Install cargo-binstall" with
    no 'run' or a non-string 'run' and assert AssertionError matching "Install
    cargo-binstall step has no run script" when calling
    _install_binstall_run_script(); use pytest.raises and monkeypatch (or similar)
    to override _load_steps so tests don't depend on action.yml.

@coderabbitai
Copy link
Copy Markdown
Contributor

coderabbitai Bot commented May 24, 2026

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
cat .github/actions/setup-rust/tests/test_setup_rust_manifest.py

Length of output: 8675


@leynos Yes, all three branches are fully covered in the current file. Specifically:

  • test_get_step_reports_missing_step — monkeypatches _load_steps to return a list without the queried name and asserts AssertionError matching "Missing setup-rust step: Nonexistent Step".
  • test_get_step_condition_requires_string_condition — monkeypatches _load_steps to return a step without an if field and asserts AssertionError matching "Step has no string condition".
  • test_install_binstall_run_script_requires_string_run — monkeypatches _load_steps to return a step without a run field and asserts AssertionError matching "Install cargo-binstall step has no run script".

All three use monkeypatch to override _load_steps, so they are independent of action.yml. The review comment is resolved.

@leynos leynos merged commit e202e43 into main May 24, 2026
24 checks passed
@leynos leynos deleted the feat/export-binstall-pin branch May 24, 2026 23:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant