From 618f92da50a5337c3aa7ca9d1193e1a72f87ffa0 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Mon, 3 Aug 2026 14:38:35 +0100 Subject: [PATCH] fix(ci): pass toolchain: explicitly to dtolnay/rust-toolchain MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `Stress Testing` fails on main with: error: invalid toolchain name '' Root cause ---------- dtolnay/rust-toolchain publishes a BRANCH PER TOOLCHAIN (`stable`, `1.91`, ...). The toolchain comes from WHICH REF YOU REFERENCE, because each branch ships its own action.yml with a matching `default:`. On master the input is: inputs: toolchain: required: true # and NO default SHA-pinning removes that signal. Pin to a commit whose action.yml lacks the default, pass no `toolchain:` input, and the job dies with an empty name. Measured -- three pins in this repository, three different action.yml files (verify with `gh api "repos/dtolnay/rust-toolchain/contents/action.yml?ref="`): 4be9e76f comment says "stable" has default: stable works b3b07ba8 comment says "stable 1.91" NO default stress-test FAILING f7ccc83f comment says "stable" NO default release ARMED; publish survives only because it already passes toolchain: ⚠ Two of those three comments say "stable" and are not. The version comment beside a SHA pin is decoration, not evidence. `release.yml` only runs on a release, so it reads healthy until it matters. Fix --- Pass `toolchain:` explicitly everywhere, which makes the pin genuinely inert: stress-test.yml added (was failing) release.yml added (was armed) cargo-audit.yml added defensively -- its pin works TODAY, but a Dependabot db-checks.yml SHA bump can land on a no-default commit, at which point the job dies and nothing in the diff explains why. Audited: every `dtolnay/rust-toolchain` use in .github/workflows now supplies `toolchain:`. Zero remaining. Verification ------------ ruby YAML parse OK and actionlint OK on all five touched/checked files. actionlint also reports one pre-existing shellcheck finding each in stress-test.yml (SC2034) and release.yml (SC2086), both inside `run:` blocks this change does not touch. Confirmed differentially -- origin/main reports exactly the same one per file, so this change introduces none. --- .github/workflows/cargo-audit.yml | 6 ++++++ .github/workflows/db-checks.yml | 6 ++++++ .github/workflows/release.yml | 5 +++++ .github/workflows/stress-test.yml | 10 ++++++++++ 4 files changed, 27 insertions(+) diff --git a/.github/workflows/cargo-audit.yml b/.github/workflows/cargo-audit.yml index 2668ec3..967fd0f 100644 --- a/.github/workflows/cargo-audit.yml +++ b/.github/workflows/cargo-audit.yml @@ -22,8 +22,14 @@ jobs: steps: - name: Checkout repository uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 + # This pin currently carries a `toolchain: default: stable`, so it works + # today. State it anyway: a Dependabot SHA bump can land on a commit with + # NO default, at which point the job dies with `invalid toolchain name ` + # and nothing in the diff explains why. See stress-test.yml. - name: Install Rust toolchain uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable + with: + toolchain: stable - name: Install cargo-audit run: cargo install cargo-audit --locked - name: Run cargo audit diff --git a/.github/workflows/db-checks.yml b/.github/workflows/db-checks.yml index 027e7bc..3dca1ee 100644 --- a/.github/workflows/db-checks.yml +++ b/.github/workflows/db-checks.yml @@ -38,8 +38,14 @@ jobs: - name: Checkout uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + # This pin currently carries a `toolchain: default: stable`, so it works + # today. State it anyway: a Dependabot SHA bump can land on a commit with + # NO default, at which point the job dies with `invalid toolchain name ` + # and nothing in the diff explains why. See stress-test.yml. - name: Install Rust toolchain uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable + with: + toolchain: stable - name: Cache cargo uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index e7e4bc0..0180e89 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -45,9 +45,14 @@ jobs: binary: echidnabot.exe steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + # ARMED, not yet fired: this pin's action.yml also has no `toolchain` + # default (see stress-test.yml for the full explanation). It only runs on + # a release, so it reads healthy until the moment it matters. publish.yml + # uses the same SHA and survives solely because it passes `toolchain:`. - name: Install Rust toolchain uses: dtolnay/rust-toolchain@f7ccc83f9ed1e5b9c81d8a67d7ad1a747e22a561 # stable with: + toolchain: stable targets: ${{ matrix.target }} - name: Install cross-compilation tools if: matrix.target == 'aarch64-unknown-linux-gnu' diff --git a/.github/workflows/stress-test.yml b/.github/workflows/stress-test.yml index 92999ef..957a0a2 100644 --- a/.github/workflows/stress-test.yml +++ b/.github/workflows/stress-test.yml @@ -11,8 +11,18 @@ jobs: timeout-minutes: 60 steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 + # dtolnay/rust-toolchain selects its toolchain from the REF it is + # referenced by (@stable, @1.91) -- each of those branches ships an + # action.yml carrying a matching `default:`. SHA-pinning removes that + # signal. MEASURED: this commit's action.yml has `toolchain: required: + # true` and NO default, so the job died with + # error: invalid toolchain name '' + # The `# stable 1.91` comment beside the pin was therefore decoration, + # not fact. Passing `toolchain:` explicitly makes the pin genuinely inert. - name: Install Rust toolchain uses: dtolnay/rust-toolchain@b3b07ba8b418998c39fb20f53e8b695cdcc8de1b # stable 1.91 + with: + toolchain: stable - name: Install stress testing tools run: |