chore(bootstrap): pin Rust toolchain to 1.95.0 (task 03)#12
Merged
Conversation
Add `rust-toolchain.toml` at the repo root pinning the toolchain to `channel = "1.95.0"` with `components = ["rustfmt", "clippy"]` and `profile = "default"`. Closes Sprint 0 reproducibility gap G6: rustup now auto-installs the exact version on first cargo invocation, removing version drift between contributors and CI. CI workflows already use `dtolnay/rust-toolchain@stable` which resolves to the same 1.95.0 build, so no workflow change is required. The `targets = [...]` array is intentionally omitted; cross-target builds are covered by the GitHub Actions OS matrix in T12. README Prerequisites updated to mention the auto-install behavior. T14 will fold this into the full quick-start section. Verified via `rustup show active-toolchain` reporting `1.95.0-x86_64-unknown-linux-gnu (overridden by rust-toolchain.toml)`.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (5)
🚧 Files skipped from review as they are similar to previous changes (4)
📝 WalkthroughWalkthroughA new ChangesRust Toolchain Pinning
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Review rate limit: 4/5 reviews remaining, refill in 12 minutes. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@CHANGELOG.md`:
- Around line 9-10: The CHANGELOG claim is incorrect because CI uses
dtolnay/rust-toolchain@stable which does not pin to rust-toolchain.toml; locate
all CI workflow files referencing dtolnay/rust-toolchain@stable and replace with
the explicit tag dtolnay/rust-toolchain@1.95.0 (or alternatively add an explicit
rustup toolchain install step after checkout) so the CI toolchain matches
rust-toolchain.toml, and update the CHANGELOG entry text (the
rust-toolchain.toml paragraph) to reflect that workflows were updated to use the
pinned dtolnay/rust-toolchain@1.95.0 (or added rustup install) rather than
claiming stable already resolved to the same version.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: f65af6d7-fa17-47e7-8dfa-f29880e2c9cd
📒 Files selected for processing (3)
CHANGELOG.mdREADME.mdrust-toolchain.toml
Contributor
Replaces `dtolnay/rust-toolchain@stable` with `@1.95.0` in 7 references across `ci.yml`, `release.yml`, `mutants.yml`, and `codspeed.yml`. The `@stable` ref ignores `rust-toolchain.toml` and installs the upstream latest stable at execution time; rust-toolchain.toml then triggers `rustup` to install the pinned 1.95.0 on first `cargo` call (file-priority override). The result is a wasteful double-install today, and silent toolchain drift the moment upstream stable advances past 1.95.0. Explicit version match keeps the workflow YAML and `rust-toolchain.toml` as a single coordinated pin: future bumps update both together in the same PR. Addresses CodeRabbit review on PR #12 (T03 follow-up). CHANGELOG updated to reflect the actual workflow change instead of the incorrect "no workflow change required" claim.
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
1 issue found across 5 files (changes from recent commits).
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name=".github/workflows/codspeed.yml">
<violation number="1" location=".github/workflows/codspeed.yml:39">
P2: `dtolnay/rust-toolchain@1.95.0` is not an immutable action pin; use a full commit SHA to make CI runs reproducible and reduce supply-chain drift.</violation>
</file>
Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.
Replaces the mutable `@1.95.0` branch ref with the corresponding full commit SHA `e081816240890017053eacbb1bdf337761dc5582` across all 7 references in `ci.yml`, `release.yml`, `mutants.yml`, and `codspeed.yml`. The `1.95.0` branch in `dtolnay/rust-toolchain` can be force-pushed by the maintainer; SHA-pinning freezes the action source, making CI runs reproducible and reducing supply-chain attack surface (third-party action takeover). Trailing comment `# 1.95.0` preserves the human-readable Rust version. Bump procedure: update `rust-toolchain.toml` channel, resolve the new branch SHA via the GitHub API, replace all 7 refs in a single PR. Addresses cubic-dev-ai review comment on PR #12.
There was a problem hiding this comment.
2 issues found across 5 files (changes from recent commits).
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name=".github/workflows/ci.yml">
<violation number="1" location=".github/workflows/ci.yml:32">
P1: Pinning `dtolnay/rust-toolchain` by commit SHA without an explicit `with.toolchain` makes the action derive the toolchain from the SHA ref instead of Rust `1.95.0`.
Add `toolchain: 1.95.0` to each pinned step.</violation>
</file>
<file name=".github/workflows/codspeed.yml">
<violation number="1" location=".github/workflows/codspeed.yml:39">
P1: Pinning `dtolnay/rust-toolchain` by SHA without `with.toolchain` can break this workflow because the action no longer has a valid toolchain specifier to install.</violation>
</file>
Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Add
rust-toolchain.tomlto pin Rust toolchain tochannel = "1.95.0"withcomponents = ["rustfmt", "clippy"]. Closes Sprint 0 reproducibility gap G6:rustupnow auto-installs the exact version on firstcargoinvocation in the repo, eliminating version drift between contributors and CI.Why
Contributors using different Rust versions locally vs CI see passing tests locally but CI failures (or vice versa). Pinning ensures bit-reproducibility across machines. Chosen
1.95.0(latest stable at 2026-05-03); CI workflows already usedtolnay/rust-toolchain@stablewhich resolves to the same version, so no workflow modification is required.Changes
rust-toolchain.toml— new file at repo root pinningchannel = "1.95.0"(exact version, not"stable"channel),components = ["rustfmt", "clippy"],profile = "default". Intentionally omitstargetsarray; cross-target builds covered by GitHub Actions matrix in task 12.README.mdPrerequisites — clarified that the exact Rust version is auto-installed fromrust-toolchain.tomlviarustup. Task 14 will expand this into the full quick-start section.CHANGELOG.md— added entry under[Unreleased] / Addeddocumenting the gap closure and auto-install behavior.Testing
rustup show active-toolchainreports1.95.0-x86_64-unknown-linux-gnu (overridden by rust-toolchain.toml).cargo fmt --check,cargo clippy --workspace -- -D warnings,cargo test --workspace— all green.cargo deny checkconfirmsadvisories ok, bans ok, licenses ok, sources ok.3 files changed).Related Issues
Notes for Reviewer
This is a minimal, non-controversial change: a new config file read transparently by Rust tooling. No code changes, no breaking changes. The toolchain is new, but it specifies a version already in use by the CI (so no surprise bumps). Later (when stable advances beyond 1.95.0), a separate PR will update this file + any affected docs; that's normal maintenance.
Checklist
Summary by CodeRabbit