fix(build): pin Rust via rust-toolchain.toml to keep Docker and CI in lockstep (#189)

* fix(build): pin Rust via rust-toolchain.toml to keep Docker and CI in lockstep

The release Docker build failed because the aws-smithy crates locked in
Cargo.lock (pulled in by the S3/object-store support, #171) require
rustc 1.94.1, while the Dockerfile builder image was pinned to
rust:1.94.0-slim. CI never caught it because workflows installed the
floating `stable` toolchain.

Make the Rust version a single source of truth:

- Add rust-toolchain.toml pinning 1.96.1. rustup resolves it for any
  cargo invocation in the repo, including inside the Docker build
  (COPY . . brings it in), so the image compiles with the pinned
  version even if the base-image tag drifts.
- Bump the Dockerfile builder to rust:1.96.1-slim so the preinstalled
  toolchain matches the pin (tag match only avoids a download).
- Replace dtolnay/rust-toolchain@stable and `rustup toolchain install
  stable` across all workflows with a bare `rustup toolchain install`,
  which installs the file-pinned version (rustup >= 1.28).

CI now fails loudly on future dependency MSRV bumps until the pin is
raised, instead of the drift surfacing only at release time.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(ci): install rustfmt component for the pinned toolchain

The old `rustup toolchain install stable` was a no-op because runners
preinstall stable with rustfmt included. The pinned 1.96.1 toolchain is
a fresh install under the runner's minimal rustup profile, which has no
rustfmt, so `cargo fmt --check` failed. Add it alongside
llvm-tools-preview in the test job's install step.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(ci): add components via rustup component add, not install flags

A bare `rustup toolchain install` (no toolchain argument) installs
exactly what rust-toolchain.toml specifies and silently ignores CLI
--component flags, so rustfmt was still missing and `cargo fmt --check`
failed again. Add rustfmt and llvm-tools-preview in a separate
`rustup component add` step, which targets the active file-pinned
toolchain and cannot be skipped.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: BtXin

.github/workflows/ci.yml

@@ -24,7 +24,9 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
+        # No toolchain argument: rustup installs the version pinned in
+        # rust-toolchain.toml, keeping CI in lockstep with the Docker build.
+        run: rustup toolchain install
       - uses: Swatinem/rust-cache@v2
       - name: Install protoc
         run: sudo apt-get install -y protobuf-compiler
@@ -157,7 +159,15 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y protobuf-compiler
       - name: Install Rust
-        run: rustup toolchain install stable --component llvm-tools-preview
+        # Version comes from rust-toolchain.toml. Runners install the pinned
+        # toolchain with the minimal profile, and a bare `rustup toolchain
+        # install` ignores CLI --component flags in favor of the toolchain
+        # file's spec — so components must be added in a second command.
+        # Kept out of the toolchain file so the Docker build doesn't pull
+        # them: rustfmt is for `cargo fmt`, llvm-tools-preview for coverage.
+        run: |
+          rustup toolchain install
+          rustup component add rustfmt llvm-tools-preview
       - name: Install cargo-llvm-cov
         uses: taiki-e/install-action@cargo-llvm-cov
       - name: install nextest

.github/workflows/docs.yml

@@ -31,7 +31,9 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
+        # No toolchain argument: rustup installs the version pinned in
+        # rust-toolchain.toml, keeping CI in lockstep with the Docker build.
+        run: rustup toolchain install
 
       - name: Cache cargo registry
         uses: actions/cache@v4

.github/workflows/draft-release.yml

@@ -62,7 +62,8 @@ jobs:
           echo "Next version: v${NEXT}-rc.${RC_NUM}"
 
       - name: Install Rust
-        run: rustup toolchain install stable
+        # Version comes from rust-toolchain.toml.
+        run: rustup toolchain install
 
       - name: Bump version in Cargo.toml and open PR
         id: pr

.github/workflows/promote-release.yml

@@ -48,7 +48,8 @@ jobs:
           echo "Promoting $RC_TAG -> $OFFICIAL"
 
       - name: Install Rust
-        run: rustup toolchain install stable
+        # Version comes from rust-toolchain.toml.
+        run: rustup toolchain install
 
       - name: Bump version in Cargo.toml and open PR
         id: pr

.github/workflows/release.yml

@@ -106,8 +106,9 @@ jobs:
           sudo rm -rf "$AGENT_TOOLSDIRECTORY"
 
       - name: Install Rust
+        # Version comes from rust-toolchain.toml.
         run: |
-          rustup toolchain install stable
+          rustup toolchain install
           rustup target add ${{ matrix.target }}
 
       - uses: Swatinem/rust-cache@v2
@@ -273,7 +274,8 @@ jobs:
           sudo apt-get install -y protobuf-compiler
 
       - name: Install Rust
-        run: rustup toolchain install stable
+        # Version comes from rust-toolchain.toml.
+        run: rustup toolchain install
 
       - uses: Swatinem/rust-cache@v2
 

Dockerfile

@@ -1,5 +1,8 @@
 # Build stage
-FROM rust:1.94.0-slim AS builder
+# The Rust version is pinned by rust-toolchain.toml (copied in with the source),
+# which rustup honors even if this tag drifts. Keep the tag matching the pin so
+# the build uses the preinstalled toolchain instead of downloading one.
+FROM rust:1.96.1-slim AS builder
 
 RUN apt-get update && apt-get install -y \
     pkg-config \

rust-toolchain.toml

@@ -0,0 +1,8 @@
+# Single source of truth for the Rust version used by local dev, CI, and the
+# Docker image build. rustup resolves this file automatically for any cargo or
+# rustup invocation inside the repo, so all environments build with the same
+# compiler. Keep the builder tag in Dockerfile in sync when bumping: a matching
+# tag only avoids a toolchain download at image-build time — correctness comes
+# from this file either way.
+[toolchain]
+channel = "1.96.1"