From 4bcbfed99b7890d287ba1d2dda0e6f9a531a80dc Mon Sep 17 00:00:00 2001 From: samuelburnham <45365069+samuelburnham@users.noreply.github.com> Date: Sat, 22 Aug 2026 14:26:26 -0400 Subject: [PATCH 1/4] chore: Update Rust to 1.98 Repin the fenix toolchain hash in flake.nix; without it every nix build fails on a hash mismatch against the 1.92 pin. Adopt build.warnings, stabilized in 1.97, in place of the two -D warnings mechanisms. It applies to local packages only, so a warning in blake3 or lean-ffi no longer fails the build, and it stays out of RUSTFLAGS, so it no longer invalidates the dependency build cache. --- .github/workflows/ci.yml | 5 +++++ flake.nix | 7 ++++--- rust-toolchain.toml | 2 +- rust/.cargo/config.toml | 4 ++++ 4 files changed, 14 insertions(+), 4 deletions(-) create mode 100644 rust/.cargo/config.toml diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 0bd09e2..7a64a02 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -28,6 +28,11 @@ jobs: steps: - uses: actions/checkout@v7 - uses: actions-rust-lang/setup-rust-toolchain@v1 + with: + # Warning handling lives in `rust/.cargo/config.toml` via + # `build.warnings`, which applies to local packages only. The action + # defaults to `-D warnings`, which also denies dependency warnings. + rustflags: "" # Only restore the cache, since the `test` job will save the test binary to the cache first - uses: actions/cache/restore@v6 with: diff --git a/flake.nix b/flake.nix index 67f3a2c..6313ab0 100644 --- a/flake.nix +++ b/flake.nix @@ -90,7 +90,7 @@ # Pins the Rust toolchain rustToolchain = fenix.packages.${system}.fromToolchainFile { file = ./rust-toolchain.toml; - sha256 = "sha256-sqSWJDUxc+zaz1nBWMAJKTAGBuGWP25GCftIOlCEAtA="; + sha256 = "sha256-P30Tm3O7vQAE725YtDCDHGjNrSsfZO4us11UwJGZSJo="; }; # Rust package @@ -164,12 +164,13 @@ }; checks = { - # Lint the Rust FFI crate; warnings are errors. + # Lint the Rust FFI crate; `build.warnings` in rust/.cargo/config.toml + # promotes warnings to errors. clippy = craneLib.cargoClippy ( craneArgs // { inherit cargoArtifacts; - cargoClippyExtraArgs = "--all-targets -- -D warnings"; + cargoClippyExtraArgs = "--all-targets"; } ); # Run the Lean test suite (exercises both the C and Rust backends) diff --git a/rust-toolchain.toml b/rust-toolchain.toml index a5b578d..23de054 100644 --- a/rust-toolchain.toml +++ b/rust-toolchain.toml @@ -1,4 +1,4 @@ [toolchain] # The default profile includes rustc, rust-std, cargo, rust-docs, rustfmt and clippy. profile = "default" -channel = "1.92" +channel = "1.98" diff --git a/rust/.cargo/config.toml b/rust/.cargo/config.toml new file mode 100644 index 0000000..2f0a8f0 --- /dev/null +++ b/rust/.cargo/config.toml @@ -0,0 +1,4 @@ +[build] +# Deny warnings from local packages; replaces RUSTFLAGS="-D warnings" in CI +# (which invalidates the build cache and also applies to dependencies). +warnings = "deny" From 47cd8682b4db3e741b582d13e80b851119a05bc3 Mon Sep 17 00:00:00 2001 From: samuelburnham <45365069+samuelburnham@users.noreply.github.com> Date: Sat, 22 Aug 2026 14:37:23 -0400 Subject: [PATCH 2/4] chore: Configure lints in Cargo.toml, deny warnings via CI env Adopt the same arrangement as lean-ffi: the lint set lives in the manifest so it applies to every cargo invocation, and CARGO_BUILD_WARNINGS promotes local-package warnings to errors in CI and in the flake's clippy check. Local builds warn rather than fail. That empties rust/.cargo/config.toml, so remove it. --- .github/workflows/ci.yml | 12 ++++++--- flake.nix | 5 ++-- rust/.cargo/config.toml | 4 --- rust/Cargo.toml | 54 ++++++++++++++++++++++++++++++++++++++++ 4 files changed, 66 insertions(+), 9 deletions(-) delete mode 100644 rust/.cargo/config.toml diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 7a64a02..48aa1f3 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -11,6 +11,12 @@ concurrency: group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }} cancel-in-progress: true +# Fail every cargo invocation on warnings from workspace-local packages +# (cargo's build.warnings, stable since 1.97). CI-only: local builds +# still just warn. +env: + CARGO_BUILD_WARNINGS: deny + jobs: lean-test: name: Lean Tests @@ -29,9 +35,9 @@ jobs: - uses: actions/checkout@v7 - uses: actions-rust-lang/setup-rust-toolchain@v1 with: - # Warning handling lives in `rust/.cargo/config.toml` via - # `build.warnings`, which applies to local packages only. The action - # defaults to `-D warnings`, which also denies dependency warnings. + # Warnings are handled by CARGO_BUILD_WARNINGS above, which applies + # to local packages only. The action defaults to `-D warnings`, + # which also denies warnings from dependencies. rustflags: "" # Only restore the cache, since the `test` job will save the test binary to the cache first - uses: actions/cache/restore@v6 diff --git a/flake.nix b/flake.nix index 6313ab0..ed1c59f 100644 --- a/flake.nix +++ b/flake.nix @@ -164,12 +164,13 @@ }; checks = { - # Lint the Rust FFI crate; `build.warnings` in rust/.cargo/config.toml - # promotes warnings to errors. + # Lint the Rust FFI crate; the lint set lives in rust/Cargo.toml and + # CARGO_BUILD_WARNINGS promotes local-package warnings to errors. clippy = craneLib.cargoClippy ( craneArgs // { inherit cargoArtifacts; + CARGO_BUILD_WARNINGS = "deny"; cargoClippyExtraArgs = "--all-targets"; } ); diff --git a/rust/.cargo/config.toml b/rust/.cargo/config.toml deleted file mode 100644 index 2f0a8f0..0000000 --- a/rust/.cargo/config.toml +++ /dev/null @@ -1,4 +0,0 @@ -[build] -# Deny warnings from local packages; replaces RUSTFLAGS="-D warnings" in CI -# (which invalidates the build cache and also applies to dependencies). -warnings = "deny" diff --git a/rust/Cargo.toml b/rust/Cargo.toml index 777f0a4..05909ad 100644 --- a/rust/Cargo.toml +++ b/rust/Cargo.toml @@ -23,3 +23,57 @@ panic = "abort" [profile.release] panic = "abort" + +[lints.rust] +invalid_reference_casting = "warn" +nonstandard_style = { level = "warn", priority = -1 } +rust_2018_idioms = { level = "warn", priority = -1 } +trivial_numeric_casts = "warn" +unreachable_pub = "warn" +unused_lifetimes = "warn" +unused_qualifications = "warn" + +[lints.clippy] +all = { level = "warn", priority = -1 } +# Casts +cast_possible_truncation = "warn" +cast_possible_wrap = "warn" +cast_precision_loss = "warn" +cast_sign_loss = "warn" +char_lit_as_u8 = "warn" +checked_conversions = "warn" +fn_to_numeric_cast = "warn" +fn_to_numeric_cast_with_truncation = "warn" +invalid_upcast_comparisons = "warn" +ptr_as_ptr = "warn" +unnecessary_cast = "warn" +# Everything else +dbg_macro = "warn" +derive_partial_eq_without_eq = "warn" +disallowed_methods = "warn" +enum_glob_use = "warn" +explicit_into_iter_loop = "warn" +fallible_impl_from = "warn" +filter_map_next = "warn" +flat_map_option = "warn" +implicit_clone = "warn" +inefficient_to_string = "warn" +large_stack_arrays = "warn" +large_types_passed_by_value = "warn" +macro_use_imports = "warn" +manual_assert = "warn" +manual_ok_or = "warn" +map_err_ignore = "warn" +map_flatten = "warn" +map_unwrap_or = "warn" +match_same_arms = "warn" +match_wild_err_arm = "warn" +needless_borrow = "warn" +needless_continue = "warn" +needless_for_each = "warn" +needless_pass_by_value = "warn" +option_option = "warn" +same_functions_in_if_condition = "warn" +trait_duplication_in_bounds = "warn" +unnecessary_wraps = "warn" +unnested_or_patterns = "warn" From d6b22a901c1246f1d0ab28e98a51806734bdd733 Mon Sep 17 00:00:00 2001 From: samuelburnham <45365069+samuelburnham@users.noreply.github.com> Date: Sat, 22 Aug 2026 15:33:48 -0400 Subject: [PATCH 3/4] Bump lean-ffi --- rust/Cargo.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rust/Cargo.toml b/rust/Cargo.toml index 05909ad..3606212 100644 --- a/rust/Cargo.toml +++ b/rust/Cargo.toml @@ -16,7 +16,7 @@ crate-type = ["staticlib", "cdylib"] [dependencies] blake3 = "1.8.7" -lean-ffi = { git = "https://github.com/argumentcomputer/lean-ffi", rev = "2a9c91eba44ea791978a086a6a19b3a922edfee5" } +lean-ffi = { git = "https://github.com/argumentcomputer/lean-ffi", rev = "93c7e52952ae94546be08313f4ff3922984c84d5" } [profile.dev] panic = "abort" From 02a32cf4fe0b4eda6c01c5df413c864bc362cc8c Mon Sep 17 00:00:00 2001 From: samuelburnham <45365069+samuelburnham@users.noreply.github.com> Date: Sat, 22 Aug 2026 16:03:32 -0400 Subject: [PATCH 4/4] fix: Sync Cargo.lock with the bumped lean-ffi rev The manifest moved to 93c7e529 while the lock still recorded 2a9c91eb. Crane vendors from the lock, so the sandboxed cargo check found no vendored source for the pinned rev and tried to fetch it over the network, which the Nix build sandbox denies. --- rust/Cargo.lock | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/rust/Cargo.lock b/rust/Cargo.lock index 3af6403..f22a78d 100644 --- a/rust/Cargo.lock +++ b/rust/Cargo.lock @@ -26,7 +26,7 @@ checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53" [[package]] name = "bignat" version = "0.1.0" -source = "git+https://github.com/argumentcomputer/lean-ffi?rev=2a9c91eba44ea791978a086a6a19b3a922edfee5#2a9c91eba44ea791978a086a6a19b3a922edfee5" +source = "git+https://github.com/argumentcomputer/lean-ffi?rev=93c7e52952ae94546be08313f4ff3922984c84d5#93c7e52952ae94546be08313f4ff3922984c84d5" dependencies = [ "num-bigint", ] @@ -159,7 +159,7 @@ dependencies = [ [[package]] name = "lean-ffi" version = "0.1.0" -source = "git+https://github.com/argumentcomputer/lean-ffi?rev=2a9c91eba44ea791978a086a6a19b3a922edfee5#2a9c91eba44ea791978a086a6a19b3a922edfee5" +source = "git+https://github.com/argumentcomputer/lean-ffi?rev=93c7e52952ae94546be08313f4ff3922984c84d5#93c7e52952ae94546be08313f4ff3922984c84d5" dependencies = [ "bignat", "bindgen",