CI: Use --locked when calling cargo public-api
What the developer wrote
Authored by Tobin C. Harding
CI: Use --locked when calling cargo public-api
Copy the `Cargo-recent.lock` file into place in CI and in the script
use `--locked` on all invocations of `cargo` that need it.
What changed, and why it matters
This is a routine continuous-integration (CI) maintenance patch. It makes the automated API-checking job use a fixed dependency lockfile and the --locked flag so builds are reproducible. There is no change to the library code that users run, and no security issue is being fixed or introduced.
No security action needed. Treat as normal CI hygiene.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The commit modifies .github/workflows/rust.yml and contrib/check-for-api-changes.sh. It adds a matrix dimension that selects the Cargo-recent.lock file, copies that lockfile to Cargo.lock before running the API checker, and passes –locked to cargo public-api invocations. This ensures the public-API check uses pinned dependency versions rather than resolving dependencies afresh. The change is purely build/CI infrastructure.
Changed components
.github/workflows/rust.ymlcontrib/check-for-api-changes.shInspect captured patch +6 / −2
diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
index 676f2072..8bf07f5b 100644
--- a/.github/workflows/rust.yml
+++ b/.github/workflows/rust.yml
@@ -311,6 +311,8 @@ jobs:
runs-on: ubuntu-24.04
strategy:
fail-fast: false
+ matrix:
+ dep: [recent]
steps:
- name: "Checkout repo"
uses: actions/checkout@v5
@@ -320,6 +322,8 @@ jobs:
toolchain: ${{ needs.Prepare.outputs.nightly_version }}
- name: "Install cargo-public-api"
run: cargo install --locked cargo-public-api --version 0.49.0
+ - name: "Set dependencies"
+ run: cp Cargo-${{ matrix.dep }}.lock Cargo.lock
- name: "Run API checker script"
run: ./contrib/check-for-api-changes.sh
diff --git a/contrib/check-for-api-changes.sh b/contrib/check-for-api-changes.sh
index b50597a0..b8d8c3f5 100755
--- a/contrib/check-for-api-changes.sh
+++ b/contrib/check-for-api-changes.sh
@@ -65,12 +65,12 @@ check_for_changes() {
# Run cargo when --all-features is not used.
run_cargo() {
- RUSTDOCFLAGS="$RUSTDOCFLAGS" cargo +"$NIGHTLY" public-api --simplified "$@"
+ RUSTDOCFLAGS="$RUSTDOCFLAGS" cargo +"$NIGHTLY" --locked public-api --simplified "$@"
}
# Run cargo with all features enabled.
run_cargo_all_features() {
- cargo +"$NIGHTLY" public-api --simplified --all-features
+ cargo +"$NIGHTLY" --locked public-api --simplified --all-features
}
need_nightly() {
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.