Skip to content

Pin one Rust toolchain for the dev shell and CI #47

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
amackillop merged 2 commits into from
Jul 29, 2026
Merged

Pin one Rust toolchain for the dev shell and CI #47

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
92d7af4
Pin one Rust toolchain for the dev shell and CI
amackillop Jul 29, 2026
34a4802
Keep release builds on RUST_VERSION despite the toml
amackillop Jul 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 11 additions & 4 deletions .github/workflows/CI.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,10 +37,11 @@ jobs:
node-version: 22
cache: 'yarn'

- name: Install
uses: dtolnay/rust-toolchain@stable
with:
components: clippy, rustfmt
# Reads rust-toolchain.toml (version and components), the same pin the
# nix dev shell builds from — a floating stable here once linted code
# the dev shell's clippy had never seen.
- name: Install Rust from rust-toolchain.toml
run: rustup toolchain install

- name: Install dependencies
run: yarn install
Expand Down Expand Up @@ -187,6 +188,7 @@ jobs:
docker run --rm \
--user 0:0 \
-e RUST_VERSION=${{ env.RUST_VERSION }} \
-e RUSTUP_TOOLCHAIN=${{ env.RUST_VERSION }} \
-v /tmp/build.sh:/tmp/build.sh \
-v ${{ github.workspace }}/.cargo-cache/git/db:/usr/local/cargo/git/db \
-v ${{ github.workspace }}/.cargo/registry/cache:/usr/local/cargo/registry/cache \
Expand All @@ -195,10 +197,15 @@ jobs:
-w /build \
${{ matrix.settings.docker }} \
sh /tmp/build.sh
# RUSTUP_TOOLCHAIN outranks rust-toolchain.toml's directory override,
# which would otherwise hijack these release builds onto the lint
# toolchain (whose cross-targets are not installed).
- name: Build
run: ${{ matrix.settings.build }}
if: ${{ !matrix.settings.docker }}
shell: bash
env:
RUSTUP_TOOLCHAIN: ${{ env.RUST_VERSION }}
- name: Upload artifact
uses: actions/upload-artifact@v4
with:
Expand Down
12 changes: 6 additions & 6 deletions flake.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

27 changes: 14 additions & 13 deletions flake.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,19 +28,14 @@

fenixPkgs = fenix.packages.${localSystem};

# Crane needs cargo >= 1.91 (`cargo package --exclude-lockfile`).
# Cargo.toml's `rust-version = "1.85"` remains the MSRV for downstream
# consumers; this toolchain is only for the dev shell and CI checks.
rustToolchain = fenixPkgs.combine [
(fenixPkgs.stable.withComponents [
"cargo"
"clippy"
"rust-src"
"rustc"
"rustfmt"
])
fenixPkgs.stable.rust-analyzer
];
# Pinned by rust-toolchain.toml so the dev shell runs the exact
# toolchain CI lints with; see the comment there. The sha256 pins the
# channel's component set and must be bumped together with the
# channel (build once with lib.fakeSha256 to learn the new one).
rustToolchain = fenixPkgs.fromToolchainFile {
file = ./rust-toolchain.toml;
sha256 = "sha256-OATSZm98Es5kIFuqaba+UvkQtFsVgJEBMmS+t6od5/U=";
};

craneLib = (crane.mkLib pkgs).overrideToolchain rustToolchain;
src = craneLib.cleanCargoSource ./.;
Expand Down Expand Up @@ -73,6 +68,12 @@
devShells.default = pkgs.mkShell {
name = "lightning-js-dev";

# Nix's fortify hardening breaks tikv-jemalloc-sys debug builds: the
# wrapper injects _FORTIFY_SOURCE, cargo passes -O0, glibc emits a
# #warning, and jemalloc's -Werror configure probes all fail
# ("cannot determine return type of strerror_r").
hardeningDisable = [ "fortify" ];

packages = with pkgs; [
nodejs_22
yarn
Expand Down
11 changes: 11 additions & 0 deletions rust-toolchain.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
# Single source of truth for the dev-shell and CI-check toolchain: the flake
# reads this via fenix fromToolchainFile and rustup reads it natively in CI,
# so the two cannot drift (a floating CI "stable" once linted code the dev
# shell's clippy had never seen). Cargo.toml's `rust-version = "1.85"` stays
# the MSRV for downstream consumers. The napi release builds pin their own
# RUST_VERSION in CI.yml and set RUSTUP_TOOLCHAIN, which outranks this file's
# directory override; without that they would silently build under this
# toolchain with no cross-targets installed.
[toolchain]
channel = "1.97.0"

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 29, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Preserve the 1.85 release-build override

In the inspected .github/workflows/CI.yml build matrix (lines 7, 84-146, and 164-169), release builds deliberately install/default Rust 1.85, but this repository-level rust-toolchain.toml overrides that default: rustup help override states that any rustc or cargo run inside an overridden directory invokes the override toolchain. Consequently, yarn build selects 1.97 despite rustup default 1.85; non-host targets installed by the action only for 1.85 are then unavailable under 1.97, so cross-build jobs can fail with a missing-target error, while other artifacts silently stop using the release pin. Set RUSTUP_TOOLCHAIN, invoke cargo +1.85, or otherwise prevent this lint/dev override from applying to the build matrix.

Useful? React with 👍 / 👎.

components = ["clippy", "rustfmt", "rust-src", "rust-analyzer"]
Loading