fix(build): pin Rust via rust-toolchain.toml to keep Docker and CI in lockstep - #189
Merged
Conversation
… lockstep The release Docker build failed because the aws-smithy crates locked in Cargo.lock (pulled in by the S3/object-store support, #171) require rustc 1.94.1, while the Dockerfile builder image was pinned to rust:1.94.0-slim. CI never caught it because workflows installed the floating `stable` toolchain. Make the Rust version a single source of truth: - Add rust-toolchain.toml pinning 1.96.1. rustup resolves it for any cargo invocation in the repo, including inside the Docker build (COPY . . brings it in), so the image compiles with the pinned version even if the base-image tag drifts. - Bump the Dockerfile builder to rust:1.96.1-slim so the preinstalled toolchain matches the pin (tag match only avoids a download). - Replace dtolnay/rust-toolchain@stable and `rustup toolchain install stable` across all workflows with a bare `rustup toolchain install`, which installs the file-pinned version (rustup >= 1.28). CI now fails loudly on future dependency MSRV bumps until the pin is raised, instead of the drift surfacing only at release time. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The old `rustup toolchain install stable` was a no-op because runners preinstall stable with rustfmt included. The pinned 1.96.1 toolchain is a fresh install under the runner's minimal rustup profile, which has no rustfmt, so `cargo fmt --check` failed. Add it alongside llvm-tools-preview in the test job's install step. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
A bare `rustup toolchain install` (no toolchain argument) installs exactly what rust-toolchain.toml specifies and silently ignores CLI --component flags, so rustfmt was still missing and `cargo fmt --check` failed again. Add rustfmt and llvm-tools-preview in a separate `rustup component add` step, which targets the active file-pinned toolchain and cannot be skipped. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
bakey
approved these changes
Aug 4, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The release Docker build failed with:
The
aws-smithy-*versions locked inCargo.lock(pulled in by the S3/object-store support, #171) require rustc 1.94.1, while the Dockerfile builder was pinned torust:1.94.0-slim— one patch too old. CI never caught it because every workflow installs the floatingstabletoolchain, so only the release image build was exposed to the drift.Fix
Make the Rust version a single source of truth so Docker, CI, and local dev move together:
rust-toolchain.tomlpinning1.96.1(current stable, matches local dev). rustup resolves it for any cargo invocation in the repo — including inside the Docker build, sinceCOPY . .brings the file in. The image therefore compiles with the pinned version even if the base-image tag drifts; the original failure mode can't recur.rust:1.96.1-slim, with a comment noting the tag match only avoids a toolchain download — correctness comes from the toolchain file.ci,docs,release,draft-release,promote-release) fromdtolnay/rust-toolchain@stable/rustup toolchain install stableto a barerustup toolchain install, which installs the file-pinned version (rustup ≥ 1.28, standard on GitHub runners).Behavior change
CI no longer floats on latest stable. A future dependency MSRV bump will fail loudly in every job until
rust-toolchain.tomlis raised (a one-line change), instead of surfacing only at release time.Verification
docker buildwith--build-arg FEATURES=rag(the exact failing release step) completed successfully with the new image.rustup show active-toolchainin the repo resolves to1.96.1 (overridden by rust-toolchain.toml).stableinstalls ordtolnay/rust-toolchainreferences remain.🤖 Generated with Claude Code