From 5761375c28ccd5882e985667fb9a8c6fe598b000 Mon Sep 17 00:00:00 2001 From: Jonathan Morley Date: Mon, 4 May 2026 16:01:00 -0400 Subject: [PATCH 1/7] Pin Rust version and sync Nix toolchain with rust-toolchain.toml Use fenix to read rust-toolchain.toml in Nix builds, ensuring all CI runners (including Windows) use the same Rust version. --- flake.lock | 71 +++++++++++++++++++++++++++++++++++++++------ flake.nix | 9 +++++- rust-toolchain.toml | 2 +- 3 files changed, 71 insertions(+), 11 deletions(-) diff --git a/flake.lock b/flake.lock index ea39ca7c..e1847fd3 100644 --- a/flake.lock +++ b/flake.lock @@ -15,16 +15,35 @@ "type": "github" } }, + "fenix": { + "inputs": { + "nixpkgs": "nixpkgs", + "rust-analyzer-src": "rust-analyzer-src" + }, + "locked": { + "lastModified": 1777884425, + "narHash": "sha256-MzIEqXcx2EzJXOqrGETHFlzx6aGP2NhLVLxrM+ej41s=", + "owner": "nix-community", + "repo": "fenix", + "rev": "18454832b8f5d6cb33910382defc793dd78306f2", + "type": "github" + }, + "original": { + "owner": "nix-community", + "repo": "fenix", + "type": "github" + } + }, "flake-parts": { "inputs": { "nixpkgs-lib": "nixpkgs-lib" }, "locked": { - "lastModified": 1777678872, - "narHash": "sha256-EPIFsulyon7Z1vLQq5Fk64GR8L7cQsT+IPhcsukVbgk=", + "lastModified": 1777898446, + "narHash": "sha256-tTEOTTjMHd8Vffn4hehLTPgOXXxJ27xfkf4DoyZgD7s=", "owner": "hercules-ci", "repo": "flake-parts", - "rev": "5250617bffd85403b14dbf43c3870e7f255d2c16", + "rev": "5d82aa3d6b5da25dbfec1a995750a70a03b8c659", "type": "github" }, "original": { @@ -35,16 +54,16 @@ }, "nixpkgs": { "locked": { - "lastModified": 1777826146, - "narHash": "sha256-wQ/iN5Zp5VIa3ebBibijPnLyKhor+xEbDy4d0goa9Zs=", + "lastModified": 1777578337, + "narHash": "sha256-Ad49moKWeXtKBJNy2ebiTQUEgdLyvGmTeykAQ9xM+Z4=", "owner": "nixos", "repo": "nixpkgs", - "rev": "73c703c22422b8951895a960959dbbaca7296492", + "rev": "15f4ee454b1dce334612fa6843b3e05cf546efab", "type": "github" }, "original": { "owner": "nixos", - "ref": "nixpkgs-unstable", + "ref": "nixos-unstable", "repo": "nixpkgs", "type": "github" } @@ -65,6 +84,22 @@ } }, "nixpkgs_2": { + "locked": { + "lastModified": 1777826146, + "narHash": "sha256-wQ/iN5Zp5VIa3ebBibijPnLyKhor+xEbDy4d0goa9Zs=", + "owner": "nixos", + "repo": "nixpkgs", + "rev": "73c703c22422b8951895a960959dbbaca7296492", + "type": "github" + }, + "original": { + "owner": "nixos", + "ref": "nixpkgs-unstable", + "repo": "nixpkgs", + "type": "github" + } + }, + "nixpkgs_3": { "locked": { "lastModified": 1770107345, "narHash": "sha256-tbS0Ebx2PiA1FRW8mt8oejR0qMXmziJmPaU1d4kYY9g=", @@ -83,14 +118,32 @@ "root": { "inputs": { "crane": "crane", + "fenix": "fenix", "flake-parts": "flake-parts", - "nixpkgs": "nixpkgs", + "nixpkgs": "nixpkgs_2", "treefmt-nix": "treefmt-nix" } }, + "rust-analyzer-src": { + "flake": false, + "locked": { + "lastModified": 1777843182, + "narHash": "sha256-AO068PumYkLmubBSjlEQKAsnhVdF1Es7NC25X3KmuOw=", + "owner": "rust-lang", + "repo": "rust-analyzer", + "rev": "f04c37286472e3687a2d32d3d1fad2772de515a1", + "type": "github" + }, + "original": { + "owner": "rust-lang", + "ref": "nightly", + "repo": "rust-analyzer", + "type": "github" + } + }, "treefmt-nix": { "inputs": { - "nixpkgs": "nixpkgs_2" + "nixpkgs": "nixpkgs_3" }, "locked": { "lastModified": 1775636079, diff --git a/flake.nix b/flake.nix index 2b8fe372..0cb3dfec 100644 --- a/flake.nix +++ b/flake.nix @@ -4,6 +4,7 @@ flake-parts.url = "github:hercules-ci/flake-parts"; crane.url = "github:ipetkov/crane"; treefmt-nix.url = "github:numtide/treefmt-nix"; + fenix.url = "github:nix-community/fenix"; }; outputs = inputs @ { @@ -24,9 +25,15 @@ pkgs, lib, system, + inputs', ... }: let - craneLib = crane.mkLib pkgs; + fenixLib = inputs'.fenix.packages; + toolchain = fenixLib.fromToolchainFile { + file = ./rust-toolchain.toml; + sha256 = "sha256-zC8E38iDVJ1oPIzCqTk/Ujo9+9kx9dXq7wAwPMpkpg0="; + }; + craneLib = (crane.mkLib pkgs).overrideToolchain toolchain; commonArgs = let # Only keeps xml files diff --git a/rust-toolchain.toml b/rust-toolchain.toml index 28384363..d82f24a4 100644 --- a/rust-toolchain.toml +++ b/rust-toolchain.toml @@ -1,3 +1,3 @@ [toolchain] -channel = "stable" +channel = "1.94.1" components = ["clippy", "rustfmt", "llvm-tools"] From e722c39d1cb194c82d8892c22e782b883a084df0 Mon Sep 17 00:00:00 2001 From: Jonathan Morley Date: Mon, 4 May 2026 16:06:17 -0400 Subject: [PATCH 2/7] Update setup-rust-toolchain action and fix Nix permissions - Update actions-rust-lang/setup-rust-toolchain from v1.0.2 to v1.16.0 to fix deprecated set-output command warning - Add id-token: write and contents: read permissions to nix job to enable FlakeHub and fix OIDC token endpoint warning --- .github/workflows/pull.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/pull.yml b/.github/workflows/pull.yml index 1e9b84fb..69073af8 100644 --- a/.github/workflows/pull.yml +++ b/.github/workflows/pull.yml @@ -16,12 +16,15 @@ jobs: - name: Checkout uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Install Rust - uses: actions-rust-lang/setup-rust-toolchain@d39b183d8d7c85028c4b64a005898c879197d13e # v1.0.2 + uses: actions-rust-lang/setup-rust-toolchain@2b1f5e9b395427c92ee4e3331786ca3c37afe2d7 # v1.16.0 - name: Clippy run: cargo clippy --all-targets --all-features -- -D warnings - name: Test run: cargo test --all-targets --all-features nix: + permissions: + contents: read + id-token: write strategy: matrix: runner: From 64b2efdd1d4e2db3d934b9a71a181b4ee298845b Mon Sep 17 00:00:00 2001 From: Jonathan Morley Date: Mon, 4 May 2026 16:08:34 -0400 Subject: [PATCH 3/7] Add concurrency to cancel superseded CI runs Cancel in-progress workflow runs when a newer commit is pushed to the same PR, reducing wasted CI resources. --- .github/workflows/pull.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/pull.yml b/.github/workflows/pull.yml index 69073af8..ec9b453b 100644 --- a/.github/workflows/pull.yml +++ b/.github/workflows/pull.yml @@ -4,6 +4,10 @@ on: pull_request: branches: [master] +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + jobs: cargo: strategy: From 9872d8d3a375f02b32592a92f559f1a66acc1091 Mon Sep 17 00:00:00 2001 From: Jonathan Morley Date: Mon, 4 May 2026 16:48:27 -0400 Subject: [PATCH 4/7] Drop macOS Intel (x86_64-darwin) support Remove x86_64-darwin from CI matrix and flake systems since Apple no longer sells Intel Macs. --- .github/workflows/pull.yml | 2 -- flake.nix | 1 - 2 files changed, 3 deletions(-) diff --git a/.github/workflows/pull.yml b/.github/workflows/pull.yml index ec9b453b..2bce0d53 100644 --- a/.github/workflows/pull.yml +++ b/.github/workflows/pull.yml @@ -33,7 +33,6 @@ jobs: matrix: runner: - ubuntu-latest # x86_64-linux - - macos-15-intel # x86_64-darwin - macos-latest # aarch64-darwin - ubuntu-24.04-arm # aarch64-linux runs-on: ${{ matrix.runner }} @@ -42,7 +41,6 @@ jobs: steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - uses: DeterminateSystems/flake-checker-action@3164002371bc90729c68af0e24d5aacf20d7c9f6 # v12 - if: matrix.runner != 'macos-15-intel' - uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22 with: github-token: ${{ secrets.GITHUB_TOKEN }} diff --git a/flake.nix b/flake.nix index 0cb3dfec..9bb2dd86 100644 --- a/flake.nix +++ b/flake.nix @@ -18,7 +18,6 @@ "aarch64-darwin" "x86_64-linux" "aarch64-linux" - "x86_64-darwin" ]; perSystem = { From c6a63b903b447a8c548f7e2aeadd4a734c217348 Mon Sep 17 00:00:00 2001 From: Jonathan Morley Date: Mon, 4 May 2026 16:58:41 -0400 Subject: [PATCH 5/7] Remove x86_64-apple-darwin from release targets Drop macOS Intel from cargo-dist build targets since Apple no longer sells Intel Macs. --- dist-workspace.toml | 1 - 1 file changed, 1 deletion(-) diff --git a/dist-workspace.toml b/dist-workspace.toml index 631f2716..17d39e1a 100644 --- a/dist-workspace.toml +++ b/dist-workspace.toml @@ -12,7 +12,6 @@ targets = [ "aarch64-apple-darwin", "aarch64-unknown-linux-gnu", #"aarch64-pc-windows-msvc", - "x86_64-apple-darwin", "x86_64-unknown-linux-gnu", "x86_64-unknown-linux-musl", "x86_64-pc-windows-msvc", From 3186914bfd7fe884079ef28cea982b4f613160ef Mon Sep 17 00:00:00 2001 From: Jonathan Morley Date: Mon, 4 May 2026 17:06:46 -0400 Subject: [PATCH 6/7] Regenerate release workflow without macOS Intel Run dist init to regenerate release.yml after removing x86_64-apple-darwin from targets. Also updates cargo-dist from 0.30.3 to 0.30.4. --- .github/workflows/release.yml | 36 +++++++++++++++++------------------ dist-workspace.toml | 11 ++--------- 2 files changed, 20 insertions(+), 27 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index c0ed1769..1d30634d 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -56,7 +56,7 @@ jobs: env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v6 with: persist-credentials: false submodules: recursive @@ -64,9 +64,9 @@ jobs: # we specify bash to get pipefail; it guards against the `curl` command # failing. otherwise `sh` won't catch that `curl` returned non-0 shell: bash - run: "curl --proto '=https' --tlsv1.2 -LsSf https://github.com/axodotdev/cargo-dist/releases/download/v0.30.3/cargo-dist-installer.sh | sh" + run: "curl --proto '=https' --tlsv1.2 -LsSf https://github.com/axodotdev/cargo-dist/releases/download/v0.30.4/cargo-dist-installer.sh | sh" - name: Cache dist - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v6 with: name: cargo-dist-cache path: ~/.cargo/bin/dist @@ -82,7 +82,7 @@ jobs: cat plan-dist-manifest.json echo "manifest=$(jq -c "." plan-dist-manifest.json)" >> "$GITHUB_OUTPUT" - name: "Upload dist-manifest.json" - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v6 with: name: artifacts-plan-dist-manifest path: plan-dist-manifest.json @@ -120,7 +120,7 @@ jobs: - name: enable windows longpaths run: | git config --global core.longpaths true - - uses: actions/checkout@v4 + - uses: actions/checkout@v6 with: persist-credentials: false submodules: recursive @@ -139,7 +139,7 @@ jobs: run: ${{ matrix.install_dist.run }} # Get the dist-manifest - name: Fetch local artifacts - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v7 with: pattern: artifacts-* path: target/distrib/ @@ -153,7 +153,7 @@ jobs: dist build ${{ needs.plan.outputs.tag-flag }} --print=linkage --output-format=json ${{ matrix.dist_args }} > dist-manifest.json echo "dist ran successfully" - name: Attest - uses: actions/attest-build-provenance@v2 + uses: actions/attest-build-provenance@v3 with: subject-path: "target/distrib/*${{ join(matrix.targets, ', ') }}*" - id: cargo-dist @@ -170,7 +170,7 @@ jobs: cp dist-manifest.json "$BUILD_MANIFEST_NAME" - name: "Upload artifacts" - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v6 with: name: artifacts-build-local-${{ join(matrix.targets, '_') }} path: | @@ -187,19 +187,19 @@ jobs: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} BUILD_MANIFEST_NAME: target/distrib/global-dist-manifest.json steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v6 with: persist-credentials: false submodules: recursive - name: Install cached dist - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v7 with: name: cargo-dist-cache path: ~/.cargo/bin/ - run: chmod +x ~/.cargo/bin/dist # Get all the local artifacts for the global tasks to use (for e.g. checksums) - name: Fetch local artifacts - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v7 with: pattern: artifacts-* path: target/distrib/ @@ -217,7 +217,7 @@ jobs: cp dist-manifest.json "$BUILD_MANIFEST_NAME" - name: "Upload artifacts" - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v6 with: name: artifacts-build-global path: | @@ -237,19 +237,19 @@ jobs: outputs: val: ${{ steps.host.outputs.manifest }} steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v6 with: persist-credentials: false submodules: recursive - name: Install cached dist - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v7 with: name: cargo-dist-cache path: ~/.cargo/bin/ - run: chmod +x ~/.cargo/bin/dist # Fetch artifacts from scratch-storage - name: Fetch artifacts - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v7 with: pattern: artifacts-* path: target/distrib/ @@ -262,14 +262,14 @@ jobs: cat dist-manifest.json echo "manifest=$(jq -c "." dist-manifest.json)" >> "$GITHUB_OUTPUT" - name: "Upload dist-manifest.json" - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v6 with: # Overwrite the previous copy name: artifacts-dist-manifest path: dist-manifest.json # Create a GitHub Release while uploading all files to it - name: "Download GitHub Artifacts" - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v7 with: pattern: artifacts-* path: artifacts @@ -302,7 +302,7 @@ jobs: env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v6 with: persist-credentials: false submodules: recursive diff --git a/dist-workspace.toml b/dist-workspace.toml index 17d39e1a..463bd039 100644 --- a/dist-workspace.toml +++ b/dist-workspace.toml @@ -2,20 +2,13 @@ # Config for 'dist' [dist] # The preferred dist version to use in CI (Cargo.toml SemVer syntax) -cargo-dist-version = "0.30.3" +cargo-dist-version = "0.30.4" # CI backends to support ci = "github" # The installers to generate for each app installers = ["shell", "powershell"] # Target platforms to build apps for (Rust target-triple syntax) -targets = [ - "aarch64-apple-darwin", - "aarch64-unknown-linux-gnu", - #"aarch64-pc-windows-msvc", - "x86_64-unknown-linux-gnu", - "x86_64-unknown-linux-musl", - "x86_64-pc-windows-msvc", -] +targets = ["aarch64-apple-darwin", "aarch64-unknown-linux-gnu", "x86_64-unknown-linux-gnu", "x86_64-unknown-linux-musl", "x86_64-pc-windows-msvc"] # Path that installers should place binaries in install-path = "CARGO_HOME" # Whether to install an updater program From 9cc8356669be35e4a398b688051dbc397ec2152a Mon Sep 17 00:00:00 2001 From: Jonathan Morley Date: Tue, 5 May 2026 13:39:39 -0400 Subject: [PATCH 7/7] Fix treefmt formatting in dist-workspace.toml Restore multi-line array format that matches project style. --- dist-workspace.toml | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/dist-workspace.toml b/dist-workspace.toml index 463bd039..7d85c061 100644 --- a/dist-workspace.toml +++ b/dist-workspace.toml @@ -8,7 +8,13 @@ ci = "github" # The installers to generate for each app installers = ["shell", "powershell"] # Target platforms to build apps for (Rust target-triple syntax) -targets = ["aarch64-apple-darwin", "aarch64-unknown-linux-gnu", "x86_64-unknown-linux-gnu", "x86_64-unknown-linux-musl", "x86_64-pc-windows-msvc"] +targets = [ + "aarch64-apple-darwin", + "aarch64-unknown-linux-gnu", + "x86_64-unknown-linux-gnu", + "x86_64-unknown-linux-musl", + "x86_64-pc-windows-msvc", +] # Path that installers should place binaries in install-path = "CARGO_HOME" # Whether to install an updater program