Skip to content

Commit 9628991

Browse files
edmorleyedmorley
committed
Add missing --locked to Cargo commands
The Cargo `--locked` argument ensures that Cargo will fail with an error if `Cargo.lock` is out of sync with `Cargo.toml`, rather than the lockfile being silently updated. As such, in CI we should always be using `--locked` for projects that have committed their lockfile to Git (which should be the case for most projects other than those that are libraries). After seeing that `cnb-otel-collector` didn't use `--locked` in all cases, I audited all of our Rust repos and found others missing `--locked` too. GUS-W-18062544.
1 parent 7a4e58c commit 9628991

File tree

3 files changed

+20
-21
lines changed

3 files changed

+20
-21
lines changed

‎.github/workflows/build_jruby.yml

+4-4
Original file line numberDiff line numberDiff line change
@@ -38,13 +38,13 @@ jobs:
3838
- name: Rust Cache
3939
uses: Swatinem/rust-cache@f0deed1e0edfc6a9be95417288c0e1099b1eeec3 # v2.7.7
4040
- name: Cargo build
41-
run: cargo build
41+
run: cargo build --locked
4242
- name: Output CHANGELOG
43-
run: cargo run --bin jruby_changelog -- --version "${{inputs.jruby_version}}"
43+
run: cargo run --locked --bin jruby_changelog -- --version "${{inputs.jruby_version}}"
4444
- name: Build Ruby
45-
run: cargo run --bin jruby_build -- --version ${{inputs.jruby_version}} --base-image ${{matrix.base_image}} \
45+
run: cargo run --locked --bin jruby_build -- --version ${{inputs.jruby_version}} --base-image ${{matrix.base_image}} \
4646
- name: Check Ruby
47-
run: cargo run --bin jruby_check -- --version ${{inputs.jruby_version}} --base-image ${{matrix.base_image}} --arch amd64 | tee $GITHUB_STEP_SUMMARY
47+
run: cargo run --locked --bin jruby_check -- --version ${{inputs.jruby_version}} --base-image ${{matrix.base_image}} --arch amd64 | tee $GITHUB_STEP_SUMMARY
4848
- name: Upload Ruby runtime archive to S3 dry run
4949
if: (inputs.dry_run)
5050
run: aws s3 sync ./output "s3://${S3_BUCKET}" --dryrun

‎.github/workflows/build_ruby.yml

+4-4
Original file line numberDiff line numberDiff line change
@@ -43,13 +43,13 @@ jobs:
4343
- name: Rust Cache
4444
uses: Swatinem/rust-cache@f0deed1e0edfc6a9be95417288c0e1099b1eeec3 # v2.7.7
4545
- name: Cargo build
46-
run: cargo build
46+
run: cargo build --locked
4747
- name: Output CHANGELOG
48-
run: cargo run --bin ruby_changelog -- --version "${{inputs.ruby_version}}"
48+
run: cargo run --locked --bin ruby_changelog -- --version "${{inputs.ruby_version}}"
4949
- name: Build Ruby
50-
run: cargo run --bin ruby_build -- --version ${{inputs.ruby_version}} --base-image ${{matrix.base_image}} --arch ${{matrix.arch}}
50+
run: cargo run --locked --bin ruby_build -- --version ${{inputs.ruby_version}} --base-image ${{matrix.base_image}} --arch ${{matrix.arch}}
5151
- name: Check Ruby
52-
run: cargo run --bin ruby_check -- --version ${{inputs.ruby_version}} --base-image ${{matrix.base_image}} --arch ${{matrix.arch}} | tee $GITHUB_STEP_SUMMARY
52+
run: cargo run --locked --bin ruby_check -- --version ${{inputs.ruby_version}} --base-image ${{matrix.base_image}} --arch ${{matrix.arch}} | tee $GITHUB_STEP_SUMMARY
5353
- name: Upload Ruby runtime archive to S3 dry run
5454
if: (inputs.dry_run)
5555
run: aws s3 sync ./output "s3://${S3_BUCKET}" --dryrun

‎.github/workflows/ci.yml

+12-13
Original file line numberDiff line numberDiff line change
@@ -26,14 +26,13 @@ jobs:
2626
uses: Swatinem/rust-cache@f0deed1e0edfc6a9be95417288c0e1099b1eeec3 # v2.7.7
2727
- name: Clippy
2828
# Using --all-targets so tests are checked and --deny to fail on warnings.
29-
# Not using --locked here and below since Cargo.lock is in .gitignore.
30-
run: cargo clippy --all-targets --all-features -- --deny warnings
29+
run: cargo clippy --all-targets --all-features --locked -- --deny warnings
3130
- name: rustfmt
3231
run: cargo fmt -- --check
3332
- name: Check docs
3433
# Using RUSTDOCFLAGS until `cargo doc --check` is stabilised:
3534
# https://github.com/rust-lang/cargo/issues/10025
36-
run: RUSTDOCFLAGS="-D warnings" cargo doc --all-features --document-private-items --no-deps
35+
run: RUSTDOCFLAGS="-D warnings" cargo doc --all-features --document-private-items --no-deps --locked
3736

3837
unit-test:
3938
runs-on: ubuntu-24.04
@@ -45,7 +44,7 @@ jobs:
4544
- name: Rust Cache
4645
uses: Swatinem/rust-cache@f0deed1e0edfc6a9be95417288c0e1099b1eeec3 # v2.7.7
4746
- name: Run unit tests
48-
run: cargo test --all-features
47+
run: cargo test --all-features --locked
4948

5049
ruby_integration_test:
5150
runs-on: ${{ matrix.arch == 'arm64' && 'pub-hk-ubuntu-24.04-arm-medium' || 'ubuntu-24.04' }}
@@ -67,13 +66,13 @@ jobs:
6766
- name: Rust Cache
6867
uses: Swatinem/rust-cache@f0deed1e0edfc6a9be95417288c0e1099b1eeec3 # v2.7.7
6968
- name: Cargo build (to make test logs shorter)
70-
run: cargo build
69+
run: cargo build --locked
7170
- name: Output CHANGELOG
72-
run: cargo run --bin ruby_changelog -- --version "${{matrix.version}}"
71+
run: cargo run --locked --bin ruby_changelog -- --version "${{matrix.version}}"
7372
- name: Build Ruby
74-
run: cargo run --bin ruby_build -- --version ${{matrix.version}} --base-image ${{matrix.base_image}} --arch ${{matrix.arch}}
73+
run: cargo run --locked --bin ruby_build -- --version ${{matrix.version}} --base-image ${{matrix.base_image}} --arch ${{matrix.arch}}
7574
- name: Check Ruby
76-
run: cargo run --bin ruby_check -- --version ${{matrix.version}} --base-image ${{matrix.base_image}} --arch ${{matrix.arch}}
75+
run: cargo run --locked --bin ruby_check -- --version ${{matrix.version}} --base-image ${{matrix.base_image}} --arch ${{matrix.arch}}
7776

7877
jruby_integration_test:
7978
runs-on: ${{ matrix.arch == 'arm64' && 'pub-hk-ubuntu-24.04-arm-medium' || 'ubuntu-24.04' }}
@@ -95,13 +94,13 @@ jobs:
9594
- name: Rust Cache
9695
uses: Swatinem/rust-cache@f0deed1e0edfc6a9be95417288c0e1099b1eeec3 # v2.7.7
9796
- name: Cargo build (to make test logs shorter)
98-
run: cargo build
97+
run: cargo build --locked
9998
- name: Output CHANGELOG
100-
run: cargo run --bin jruby_changelog -- --version "${{matrix.version}}"
99+
run: cargo run --locked --bin jruby_changelog -- --version "${{matrix.version}}"
101100
- name: Build JRuby
102-
run: cargo run --bin jruby_build -- --version ${{matrix.version}} --base-image ${{matrix.base_image}}
101+
run: cargo run --locked --bin jruby_build -- --version ${{matrix.version}} --base-image ${{matrix.base_image}}
103102
- name: Check JRuby
104-
run: cargo run --bin jruby_check -- --version ${{matrix.version}} --base-image ${{matrix.base_image}} --arch ${{matrix.arch}}
103+
run: cargo run --locked --bin jruby_check -- --version ${{matrix.version}} --base-image ${{matrix.base_image}} --arch ${{matrix.arch}}
105104

106105
check_inventory_urls:
107106
runs-on: ubuntu-24.04
@@ -120,4 +119,4 @@ jobs:
120119
git fetch origin ${{ github.base_ref }} --depth 1 && \
121120
git diff --unified=0 remotes/origin/${{ github.base_ref }} ${{matrix.inventory}} | grep '^+' | grep -v '^+++' | cut -c2- > check_inventory.toml
122121
- name: Check manifest URLs
123-
run: cargo run --bin inventory_check -- check_inventory.toml
122+
run: cargo run --locked --bin inventory_check -- check_inventory.toml

0 commit comments

Comments
 (0)