chore: for CI cargo update use precise version

Author: mootz12

.github/workflows/test-with-openzeppelin-stellar-contracts.yml

@@ -70,18 +70,19 @@ jobs:
     - name: Collect publishable rs-soroban-sdk crates
       working-directory: stellar-contracts
       run: |
-        # Collect the publishable rs-soroban-sdk crates and their directories once,
-        # from the authoritative cargo metadata, deriving the path from manifest_path
-        # rather than assuming the package name matches the directory name. The list is
-        # reused by the patching steps below.
+        # Collect the publishable rs-soroban-sdk crates, their directories, and their
+        # versions once, from the authoritative cargo metadata, deriving the path from
+        # manifest_path rather than assuming the package name matches the directory
+        # name. The list (name<TAB>dir<TAB>version) is reused by the patching steps
+        # below.
         (cd ../rs-soroban-sdk && cargo metadata --format-version 1 --no-deps) \
-          | jq -r '.packages[] | select(.publish != []) | "\(.name)\t\(.manifest_path | sub("/Cargo.toml$"; ""))"' \
+          | jq -r '.packages[] | select(.publish != []) | "\(.name)\t\(.manifest_path | sub("/Cargo.toml$"; ""))\t\(.version)"' \
           > "$RUNNER_TEMP/sdk-crates.tsv"
 
     - name: Patch workspace dependencies
       working-directory: stellar-contracts
       run: |
-        while IFS=$'\t' read -r crate dir; do
+        while IFS=$'\t' read -r crate dir version; do
           rel_path=$(realpath --relative-to="." "$dir")
           sed -i 's|'"$crate"' = "\([^"]*\)"|'"$crate"' = { path = "'"$rel_path"'" }|g' Cargo.toml
           sed -i 's|'"$crate"' = { \(.*\)version = "[^"]*"\(.*\)|'"$crate"' = { \1path = "'"$rel_path"'" \2|g' Cargo.toml
@@ -113,23 +114,33 @@ jobs:
         #      A [patch] entry adds the path crate's version to crates.io resolution,
         #      but on its own it leaves a transitive edge the lock pinned to a
         #      different registry version untouched.
-        #   2. cargo update each crate so that edge re-resolves onto the patched
-        #      version, leaving a single local copy in the graph. (Can't rescue an
+        #   2. Pin each patched crate that the lock already references to the local
+        #      checkout's version with `cargo update --precise`, so the transitive
+        #      edges move onto it. Pinning (rather than letting cargo pick the highest
+        #      compatible version) stops a newer *published* SDK from being chosen for a
+        #      transitive edge and re-splitting the graph. (Can't rescue an
         #      incompatible-major transitive dep; that would need the remedy in #1723.)
         if [ -s "$RUNNER_TEMP/sdk-crates.tsv" ]; then
           # Don't emit a second [patch.crates-io] header if one already exists upstream.
           grep -q '^\[patch\.crates-io\]' Cargo.toml || printf '\n[patch.crates-io]\n' >> Cargo.toml
-          while IFS=$'\t' read -r crate dir; do
+          while IFS=$'\t' read -r crate dir version; do
             rel_path=$(realpath --relative-to="." "$dir")
             echo "$crate = { path = \"$rel_path\" }" >> Cargo.toml
           done < "$RUNNER_TEMP/sdk-crates.tsv"
-          # Re-resolve only the patched crates that are actually in the graph.
-          graph=$(cargo metadata --format-version 1 | jq -r '.packages[].name')
-          while IFS=$'\t' read -r crate dir; do
-            if grep -qxF "$crate" <<< "$graph"; then
-              cargo update -p "$crate"
+          # Build the -p specs from crates the committed lock already references.
+          # All crates share one workspace version, so a single --precise re-resolves
+          # everything in one pass (no stale intermediate locks).
+          specs=()
+          precise=
+          while IFS=$'\t' read -r crate dir version; do
+            if grep -q "^name = \"$crate\"\$" Cargo.lock; then
+              specs+=( -p "$crate" )
+              precise=$version
             fi
           done < "$RUNNER_TEMP/sdk-crates.tsv"
+          if [ "${#specs[@]}" -gt 0 ]; then
+            cargo update "${specs[@]}" --precise "$precise"
+          fi
         fi
 
     - name: Diff

.github/workflows/test-with-soroban-examples.yml

@@ -84,12 +84,13 @@ jobs:
 
     - name: Collect publishable rs-soroban-sdk crates
       run: |
-        # Collect the publishable rs-soroban-sdk crates and their directories once, from
-        # the authoritative cargo metadata, deriving the path from manifest_path rather
-        # than assuming the package name matches the directory name. The list is reused
-        # by the patching steps below.
+        # Collect the publishable rs-soroban-sdk crates, their directories, and their
+        # versions once, from the authoritative cargo metadata, deriving the path from
+        # manifest_path rather than assuming the package name matches the directory
+        # name. The list (name<TAB>dir<TAB>version) is reused by the patching steps
+        # below.
         (cd ${{ github.workspace }}/rs-soroban-sdk && cargo metadata --format-version 1 --no-deps) \
-          | jq -r '.packages[] | select(.publish != []) | "\(.name)\t\(.manifest_path | sub("/Cargo.toml$"; ""))"' \
+          | jq -r '.packages[] | select(.publish != []) | "\(.name)\t\(.manifest_path | sub("/Cargo.toml$"; ""))\t\(.version)"' \
           > "$RUNNER_TEMP/sdk-crates.tsv"
 
     - name: Patch SDK versions
@@ -104,7 +105,7 @@ jobs:
         echo "$files" | sort -u | while read -r file; do
           echo Patching "$file" ...
           dir=$(dirname "$file")
-          while IFS=$'\t' read -r crate crate_dir; do
+          while IFS=$'\t' read -r crate crate_dir version; do
             rel_path=$(realpath --relative-to="$dir" "$crate_dir")
             sed -i 's|'"$crate"' = "\([^"]*\)"|'"$crate"' = { path = "'"$rel_path"'" }|g' "$file"
             sed -i 's|'"$crate"' = {.*version = "[^"]*"\(.*\)|'"$crate"' = { path = "'"$rel_path"'" \1|g' "$file"
@@ -138,25 +139,35 @@ jobs:
         #      A [patch] entry adds the path crate's version to crates.io resolution,
         #      but on its own it leaves a transitive edge the lock pinned to a
         #      different registry version untouched.
-        #   2. cargo update each crate so that edge re-resolves onto the patched
-        #      version, leaving a single local copy in the graph. (Can't rescue an
+        #   2. Pin each patched crate that the lock already references to the local
+        #      checkout's version with `cargo update --precise`, so the transitive
+        #      edges move onto it. Pinning (rather than letting cargo pick the highest
+        #      compatible version) stops a newer *published* SDK from being chosen for a
+        #      transitive edge and re-splitting the graph. (Can't rescue an
         #      incompatible-major transitive dep, so the matrix exclusion is still
         #      needed.)
         workspace_root=$(cargo metadata --format-version 1 --no-deps | jq -r '.workspace_root')
         if [ -s "$RUNNER_TEMP/sdk-crates.tsv" ]; then
           # Don't emit a second [patch.crates-io] header if one already exists upstream.
           grep -q '^\[patch\.crates-io\]' "$workspace_root/Cargo.toml" || printf '\n[patch.crates-io]\n' >> "$workspace_root/Cargo.toml"
-          while IFS=$'\t' read -r crate crate_dir; do
+          while IFS=$'\t' read -r crate crate_dir version; do
             rel_path=$(realpath --relative-to="$workspace_root" "$crate_dir")
             echo "$crate = { path = \"$rel_path\" }" >> "$workspace_root/Cargo.toml"
           done < "$RUNNER_TEMP/sdk-crates.tsv"
-          # Re-resolve only the patched crates that are actually in the graph.
-          graph=$(cargo metadata --format-version 1 | jq -r '.packages[].name')
-          while IFS=$'\t' read -r crate crate_dir; do
-            if grep -qxF "$crate" <<< "$graph"; then
-              cargo update -p "$crate"
+          # Build the -p specs from crates the committed lock already references.
+          # All crates share one workspace version, so a single --precise re-resolves
+          # everything in one pass (no stale intermediate locks).
+          specs=()
+          precise=
+          while IFS=$'\t' read -r crate crate_dir version; do
+            if grep -q "^name = \"$crate\"\$" "$workspace_root/Cargo.lock"; then
+              specs+=( -p "$crate" )
+              precise=$version
             fi
           done < "$RUNNER_TEMP/sdk-crates.tsv"
+          if [ "${#specs[@]}" -gt 0 ]; then
+            cargo update "${specs[@]}" --precise "$precise"
+          fi
         fi
 
     - name: Diff