fix(ci): add --locked to cargo invocations and bump actions/cache to v4 (#171) - #259
fix(ci): add --locked to cargo invocations and bump actions/cache to v4 (#171)#259aurorabini wants to merge 3 commits into
Conversation
|
Needs changes The PR misses updating CONTRIBUTING.md as specified in the issue requirements.
Reviewed commit: |
![mergekeeper[bot]](https://avatars.githubusercontent.com/u/173216192?s=60&v=4){kind=small}
There was a problem hiding this comment.
Needs changes
Missing documentation update in CONTRIBUTING.md as specified in the issue requirements.
CONTRIBUTING.md: Issue #171 acceptance criteria / instructions specify documenting the expectation in CONTRIBUTING.md that Cargo.lock is committed deliberately, but no documentation file was updated in this PR.
Reviewed commit: fb846fbd039725f49ffe1c391923fd69cbbd4492.
There was a problem hiding this comment.
Needs changes
The PR misses updating CONTRIBUTING.md as specified in the issue requirements.
- Review finding: Issue item 4 requires documenting the Cargo.lock expectation in CONTRIBUTING.md, but no changes to CONTRIBUTING.md were included in the pull request.
Reviewed commit: 160a388899a59d52a82df53e568de1934e725b11.
|
MergeKeeper review Scope: in scope for linked issue The pull request correctly implements all requirements of issue 171 by adding --locked to all cargo invocations in ci.yml, upgrading actions/cache to v4 across all jobs, and documenting the Cargo.lock expectation in CONTRIBUTING.md. Reviewed commit: |
2 participants
Add --locked to CI and bump actions/cache
Ensures CI builds against the exact committed Cargo.lock rather than allowing
Cargo to resolve newer compatible versions in-place.
Changes
--lockedto all cargo invocations in ci.yml (clippy, test, build-wasm, benchmark)actions/cachefrom v3 to v4 in all jobsWhy this matters
The lockfile is committed but CI never required it. Cargo was free to update
dependencies in-place, meaning two CI runs of the same commit a week apart
could build different WASM bytes — undermining the build's traceability to a
specific commit.
Closes #171