Merge pull request #8 from Spacecraft-Software/ci-pin-toolchain

ci: pin the Rust toolchain to 1.95.0 instead of floating stable

Author: UnbreakableMJ

.github/workflows/ci.yml

@@ -10,6 +10,10 @@ on:
 env:
   CARGO_TERM_COLOR: always
   RUSTFLAGS: "-D warnings"
+  # Pin the toolchain so CI matches local dev (no rustup here — the dev box is
+  # Nix-pinned at this version) and clippy/rustfmt can't drift ahead on the
+  # runner. Keep in sync with rust-toolchain.toml; bump both together.
+  RUST_TOOLCHAIN: "1.95.0"
 
 jobs:
   fmt:
@@ -19,6 +23,7 @@ jobs:
       - uses: actions/checkout@v5
       - uses: dtolnay/rust-toolchain@stable
         with:
+          toolchain: ${{ env.RUST_TOOLCHAIN }}
           components: rustfmt
       - run: cargo fmt --all -- --check
 
@@ -29,6 +34,7 @@ jobs:
       - uses: actions/checkout@v5
       - uses: dtolnay/rust-toolchain@stable
         with:
+          toolchain: ${{ env.RUST_TOOLCHAIN }}
           components: clippy
       - uses: Swatinem/rust-cache@v2
       - run: cargo clippy --workspace --all-targets --all-features -- -D warnings
@@ -43,6 +49,8 @@ jobs:
     steps:
       - uses: actions/checkout@v5
       - uses: dtolnay/rust-toolchain@stable
+        with:
+          toolchain: ${{ env.RUST_TOOLCHAIN }}
       - uses: Swatinem/rust-cache@v2
       - run: cargo build --workspace --all-targets
       - run: cargo test --workspace --all-targets
@@ -53,6 +61,8 @@ jobs:
     steps:
       - uses: actions/checkout@v5
       - uses: dtolnay/rust-toolchain@stable
+        with:
+          toolchain: ${{ env.RUST_TOOLCHAIN }}
       - uses: Swatinem/rust-cache@v2
       # PRD G6: the server install path must keep building — the CLI behind
       # its `cli` feature gate, and the agent without the clipboard's
@@ -66,6 +76,8 @@ jobs:
     steps:
       - uses: actions/checkout@v5
       - uses: dtolnay/rust-toolchain@stable
+        with:
+          toolchain: ${{ env.RUST_TOOLCHAIN }}
       - uses: Swatinem/rust-cache@v2
       - run: cargo build --bin vault --release
       - name: Verify attribution block
@@ -88,6 +100,8 @@ jobs:
     steps:
       - uses: actions/checkout@v5
       - uses: dtolnay/rust-toolchain@stable
+        with:
+          toolchain: ${{ env.RUST_TOOLCHAIN }}
       - uses: rustsec/audit-check@v2
         with:
           token: ${{ secrets.GITHUB_TOKEN }}

rust-toolchain.toml

@@ -1,5 +1,9 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
+# Pinned (not "stable") so CI and local dev run the *same* clippy/rustfmt and
+# lints can't appear only on the runner. Keep this in sync with
+# RUST_TOOLCHAIN in .github/workflows/ci.yml; bump both together (and the dev
+# environment) in a dedicated change.
 [toolchain]
-channel = "stable"
+channel = "1.95.0"
 components = ["rustfmt", "clippy"]
 profile = "minimal"