From 66e73f9910a1b5e9b52b7d1dddaf572f9e39afc6 Mon Sep 17 00:00:00 2001 From: Quentin Gliech Date: Wed, 26 Aug 2026 11:23:44 +0200 Subject: [PATCH 1/3] Pin the Rust toolchain with a `rust-toolchain.toml` Until now only the clippy CI job and the Dockerfile named a Rust version (kept in sync by hand), while every other CI job, the release binaries and the docs build ran on whatever `stable` happened to be that day. Rust 1.98.0 landing on 2026-08-20 broke `build-binaries` overnight because of that (#5935). `rust-toolchain.toml` pins 1.96.0 with the `minimal` profile plus clippy, and every `rustup toolchain install stable ...` in CI becomes a bare `rustup toolchain install`, which reads the file. Starting at 1.96.0 (the version clippy is already clean against) keeps this change free of lint churn; catching up to 1.98.0 is a follow-up. rustfmt stays on nightly because `.rustfmt.toml` uses nightly-only options, so that job now invokes `cargo +nightly fmt` explicitly instead of setting a rustup directory override, which would silently take precedence over the toolchain file. The file does not list the linux cross-compilation targets on purpose: that would make every developer and CI job download `rust-std` they never use. The two consumers that cross-compile add the targets themselves. --- .github/workflows/build.yaml | 4 ++-- .github/workflows/ci.yaml | 27 ++++++++------------------- .github/workflows/coverage.yaml | 7 ++++--- .github/workflows/docs.yaml | 4 ++-- .github/workflows/release-branch.yaml | 4 ++-- .github/workflows/release-bump.yaml | 4 ++-- .github/workflows/tag.yaml | 4 ++-- docs/development/contributing.md | 4 ++-- docs/setup/installation.md | 2 +- misc/build-docs.sh | 5 +++-- rust-toolchain.toml | 11 +++++++++++ 11 files changed, 39 insertions(+), 37 deletions(-) create mode 100644 rust-toolchain.toml diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml index d2e412bc7..54a35fa4f 100644 --- a/.github/workflows/build.yaml +++ b/.github/workflows/build.yaml @@ -1,3 +1,4 @@ +# Copyright 2025, 2026 Element Creations Ltd. # Copyright 2025 New Vector Ltd. # # SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-Element-Commercial @@ -123,9 +124,8 @@ jobs: persist-credentials: false - name: Install Rust toolchain - # Install the minimal toolchain, which includes rustc, rustdoc, and cargo. run: | - rustup toolchain install stable --profile minimal + rustup toolchain install rustup target add ${{ matrix.target }} - name: Setup sccache diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 0640b7fb9..026a9a785 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -153,15 +153,12 @@ jobs: persist-credentials: false - name: Install Rust toolchain - # Install the minimal toolchain, which includes rustc, rustdoc, and cargo. - # Then install rustfmt for `cargo fmt`. - # - # --override sets this as the default rust toolchain version in this directory. + # rustfmt runs on nightly because .rustfmt.toml uses nightly-only options. run: | - rustup toolchain install nightly --profile minimal --component rustfmt --override + rustup toolchain install nightly --profile minimal --component rustfmt - name: Check style - run: cargo fmt --all -- --check + run: cargo +nightly fmt --all -- --check cargo-deny: name: Run `cargo deny` checks @@ -182,8 +179,6 @@ jobs: - name: Run `cargo-deny` uses: EmbarkStudios/cargo-deny-action@3c6349835b2b7b196a839186cb8b78e02f7b5f25 # v2.1.1 - with: - rust-version: stable check-schema: name: Check schema @@ -200,7 +195,7 @@ jobs: - name: Install Rust toolchain run: | - rustup toolchain install stable + rustup toolchain install - name: Setup sccache uses: mozilla-actions/sccache-action@9e7fa8a12102821edf02ca5dbea1acd0f89a2696 # v0.0.10 @@ -241,11 +236,7 @@ jobs: persist-credentials: false - name: Install Rust toolchain - # Install the minimal toolchain with clippy, pinned to a version kept in - # sync with Dockerfile. - # - # --override sets this as the default rust toolchain version in this directory. - run: rustup toolchain install 1.96.0 --profile minimal --component clippy --override + run: rustup toolchain install - uses: ./.github/actions/build-policies @@ -270,8 +261,7 @@ jobs: persist-credentials: false - name: Install Rust toolchain - # Install the minimal toolchain, which includes rustc, rustdoc, and cargo. - run: rustup toolchain install stable --profile minimal + run: rustup toolchain install - name: Install nextest uses: taiki-e/install-action@b8cecb83565409bcc297b2df6e77f030b2a468d5 # v2 @@ -293,7 +283,7 @@ jobs: path: nextest-archive.tar.zst test: - name: Run test suite with Rust stable + name: Run test suite needs: [rustfmt, opa-lint, compile-test-artifacts] runs-on: ubuntu-24.04 @@ -326,8 +316,7 @@ jobs: persist-credentials: false - name: Install Rust toolchain - # Install the minimal toolchain, which includes rustc, rustdoc, and cargo. - run: rustup toolchain install stable --profile minimal + run: rustup toolchain install - name: Install nextest uses: taiki-e/install-action@b8cecb83565409bcc297b2df6e77f030b2a468d5 # v2 diff --git a/.github/workflows/coverage.yaml b/.github/workflows/coverage.yaml index 8393d8e92..bbe9989b5 100644 --- a/.github/workflows/coverage.yaml +++ b/.github/workflows/coverage.yaml @@ -1,3 +1,4 @@ +# Copyright 2025, 2026 Element Creations Ltd. # Copyright 2025 New Vector Ltd. # # SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-Element-Commercial @@ -107,11 +108,11 @@ jobs: persist-credentials: false - name: Install Rust toolchain - # Install the minimal toolchain, which includes rustc, rustdoc, and cargo. - # # llvm-tools-preview installs some llvm tools, which are needed for `grcov` below. # See https://github.com/rust-lang/rust/issues/85658 for stability tracking issue. - run: rustup toolchain install stable --profile minimal --component llvm-tools-preview + run: | + rustup toolchain install + rustup component add llvm-tools-preview - name: Setup sccache uses: mozilla-actions/sccache-action@9e7fa8a12102821edf02ca5dbea1acd0f89a2696 # v0.0.10 diff --git a/.github/workflows/docs.yaml b/.github/workflows/docs.yaml index e2020ef33..74b9ee99b 100644 --- a/.github/workflows/docs.yaml +++ b/.github/workflows/docs.yaml @@ -1,3 +1,4 @@ +# Copyright 2025, 2026 Element Creations Ltd. # Copyright 2025 New Vector Ltd. # # SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-Element-Commercial @@ -30,8 +31,7 @@ jobs: persist-credentials: false - name: Install Rust toolchain - # Install the minimal toolchain, which includes rustc, rustdoc, and cargo - run: rustup toolchain install stable --profile minimal + run: rustup toolchain install - name: Setup sccache uses: mozilla-actions/sccache-action@9e7fa8a12102821edf02ca5dbea1acd0f89a2696 # v0.0.10 diff --git a/.github/workflows/release-branch.yaml b/.github/workflows/release-branch.yaml index 68788d1bb..637acc053 100644 --- a/.github/workflows/release-branch.yaml +++ b/.github/workflows/release-branch.yaml @@ -1,3 +1,4 @@ +# Copyright 2025, 2026 Element Creations Ltd. # Copyright 2025 New Vector Ltd. # # SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-Element-Commercial @@ -39,8 +40,7 @@ jobs: persist-credentials: false - name: Install Rust toolchain - # Only the minimal profile is required here to run `cargo metadata` - run: rustup toolchain install stable --profile minimal + run: rustup toolchain install - name: Install pnpm uses: pnpm/action-setup@v6.0.9 diff --git a/.github/workflows/release-bump.yaml b/.github/workflows/release-bump.yaml index d5467d5d8..ae095b1c5 100644 --- a/.github/workflows/release-bump.yaml +++ b/.github/workflows/release-bump.yaml @@ -1,3 +1,4 @@ +# Copyright 2025, 2026 Element Creations Ltd. # Copyright 2025 New Vector Ltd. # # SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-Element-Commercial @@ -38,8 +39,7 @@ jobs: persist-credentials: false - name: Install Rust toolchain - # Only the minimal profile is required here to run `cargo` - run: rustup toolchain install stable --profile minimal + run: rustup toolchain install - name: Install pnpm uses: pnpm/action-setup@v6.0.9 diff --git a/.github/workflows/tag.yaml b/.github/workflows/tag.yaml index fba71867d..c52fa107d 100644 --- a/.github/workflows/tag.yaml +++ b/.github/workflows/tag.yaml @@ -1,3 +1,4 @@ +# Copyright 2025, 2026 Element Creations Ltd. # Copyright 2025 New Vector Ltd. # # SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-Element-Commercial @@ -35,8 +36,7 @@ jobs: persist-credentials: false - name: Install Rust toolchain - # Only the minimal profile is required here to run `cargo metadata` - run: rustup toolchain install stable --profile minimal + run: rustup toolchain install - name: Set the crates version env: diff --git a/docs/development/contributing.md b/docs/development/contributing.md index e0c962f83..e8a32ccbf 100644 --- a/docs/development/contributing.md +++ b/docs/development/contributing.md @@ -19,7 +19,7 @@ There are two main ways to contribute to MAS: To get MAS running locally from source you will need to: -- [Install Rust and Cargo](https://www.rust-lang.org/learn/get-started). We recommend using the latest stable version of Rust. +- [Install Rust and Cargo](https://www.rust-lang.org/learn/get-started). The exact version is pinned in `rust-toolchain.toml`; rustup installs it automatically when you run cargo in the repo. - [Install Node.js](https://nodejs.org/). We recommend using the latest LTS version of Node.js. The frontend uses pnpm, which is installed automatically via corepack — see below. - [Install Open Policy Agent](https://www.openpolicyagent.org/docs#1-download-opa) @@ -79,7 +79,7 @@ Most of them can be updated by running `sh misc/update.sh` at the root of the pr Make sure your code adheres to our Rust and TypeScript code style by running: - - `cargo +nightly fmt` (with the nightly toolchain installed) + - `cargo +nightly fmt` (`.rustfmt.toml` uses nightly-only options, so this needs the nightly toolchain installed) - `pnpm run format` in the `frontend` directory - `make fmt` in the `policies` directory (if changed) diff --git a/docs/setup/installation.md b/docs/setup/installation.md index f444f1bdf..bcdb7fbd4 100644 --- a/docs/setup/installation.md +++ b/docs/setup/installation.md @@ -63,7 +63,7 @@ The image can also be built from the source: Building from the source requires: -- The latest stable [Rust toolchain](https://www.rust-lang.org/learn/get-started) +- The [Rust toolchain](https://www.rust-lang.org/learn/get-started) pinned by `rust-toolchain.toml` (installed automatically by rustup) - [Node.js (24 and later)](https://nodejs.org/en/), with [corepack](https://nodejs.org/api/corepack.html) enabled so pnpm@11 is provisioned automatically - the [Open Policy Agent](https://www.openpolicyagent.org/docs/latest/#running-opa) binary (or alternatively, Docker) diff --git a/misc/build-docs.sh b/misc/build-docs.sh index 390c1376f..da0bed402 100644 --- a/misc/build-docs.sh +++ b/misc/build-docs.sh @@ -1,5 +1,6 @@ #!/bin/sh +# Copyright 2025, 2026 Element Creations Ltd. # Copyright 2025 New Vector Ltd. # # SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-Element-Commercial @@ -22,8 +23,8 @@ if [ "${CF_PAGES:-""}" = "1" ]; then # Source the environment variables to add cargo to the path . "$HOME/.cargo/env" - # Install the minimal toolchain, which includes rustc, rustdoc, and cargo - rustup toolchain install stable --profile minimal + # Install the toolchain pinned in rust-toolchain.toml + rustup toolchain install # Install mdbook MDBOOK_URL="https://github.com/rust-lang/mdBook/releases/download/v${MDBOOK_VERSION}/mdbook-v${MDBOOK_VERSION}-$(uname -m)-unknown-linux-gnu.tar.gz" diff --git a/rust-toolchain.toml b/rust-toolchain.toml new file mode 100644 index 000000000..c0b6afb91 --- /dev/null +++ b/rust-toolchain.toml @@ -0,0 +1,11 @@ +# Copyright 2026 Element Creations Ltd. +# +# SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-Element-Commercial +# Please see LICENSE files in the repository root for full details. + +[toolchain] +channel = "1.96.0" +profile = "minimal" +# No rustfmt: .rustfmt.toml uses nightly-only options, so formatting runs as `cargo +nightly fmt`. +# No cross-compilation targets: the Dockerfile and build.yaml add the ones they need. +components = ["clippy"] From 507d49829430c1e05087d82e78245d10d4859c4c Mon Sep 17 00:00:00 2001 From: Quentin Gliech Date: Wed, 26 Aug 2026 11:23:44 +0200 Subject: [PATCH 2/3] Install the Rust toolchain in the Dockerfile from `rust-toolchain.toml` The builder stage starts from `buildpack-deps` (what the `rust:` image is built on anyway), installs a pinned `rustup-init` with `--default-toolchain none`, copies only `rust-toolchain.toml` and lets rustup install the toolchain it names. The Rust version is now written in exactly one place, shared with CI, so a toolchain bump needs no Dockerfile edit. The toolchain layer is cached on the content of `rust-toolchain.toml` and the base image, and it is the same bytes we pulled as `rust:` image layers before, so build times are unchanged. The registry cache mount also moves to `/usr/local/cargo/registry`: the `rust:` image already set `CARGO_HOME=/usr/local/cargo`, so the previous `/root/.cargo/registry` mount never held anything. --- Dockerfile | 52 ++++++++++++++++++++++++++++++++++++---------------- 1 file changed, 36 insertions(+), 16 deletions(-) diff --git a/Dockerfile b/Dockerfile index b7e3b2bd2..899ef0710 100644 --- a/Dockerfile +++ b/Dockerfile @@ -13,8 +13,7 @@ # The Debian version and version name must be in sync ARG DEBIAN_VERSION=13 ARG DEBIAN_VERSION_NAME=trixie -# Keep in sync with .github/workflows/ci.yaml -ARG RUSTC_VERSION=1.96.0 +ARG RUSTUP_VERSION=1.29.0 # Keep in sync with .node-version ARG NODEJS_VERSION=24.15.0 # Keep in sync with .github/actions/build-policies/action.yml and policies/Makefile @@ -76,10 +75,42 @@ RUN --network=none \ ######################################## ## Build stage that builds the binary ## ######################################## -FROM --platform=${BUILDPLATFORM} docker.io/library/rust:${RUSTC_VERSION}-${DEBIAN_VERSION_NAME} AS builder +FROM --platform=${BUILDPLATFORM} docker.io/library/buildpack-deps:${DEBIAN_VERSION_NAME} AS builder +ARG BUILDARCH ARG CARGO_AUDITABLE_VERSION -ARG RUSTC_VERSION +ARG RUSTUP_VERSION + +ENV RUSTUP_HOME=/usr/local/rustup \ + CARGO_HOME=/usr/local/cargo \ + PATH=/usr/local/cargo/bin:$PATH + +# Checksums come from https://static.rust-lang.org/rustup/archive///rustup-init.sha256 +# Network access: to download rustup +RUN --network=default \ + case "${BUILDARCH}" in \ + amd64) RUSTUP_TRIPLE="x86_64-unknown-linux-gnu"; RUSTUP_SHA256="4acc9acc76d5079515b46346a485974457b5a79893cfb01112423c89aeb5aa10" ;; \ + arm64) RUSTUP_TRIPLE="aarch64-unknown-linux-gnu"; RUSTUP_SHA256="9732d6c5e2a098d3521fca8145d826ae0aaa067ef2385ead08e6feac88fa5792" ;; \ + *) echo "unsupported architecture: ${BUILDARCH}" >&2; exit 1 ;; \ + esac && \ + curl -fsSLo rustup-init "https://static.rust-lang.org/rustup/archive/${RUSTUP_VERSION}/${RUSTUP_TRIPLE}/rustup-init" && \ + echo "${RUSTUP_SHA256} *rustup-init" | sha256sum -c - && \ + chmod +x rustup-init && \ + ./rustup-init -y --no-modify-path --default-toolchain none && \ + rm rustup-init + +# Set the working directory +WORKDIR /app + +# Copied on its own so the toolchain layer is cached independently of the source tree +COPY rust-toolchain.toml ./ + +# Network access: to download the toolchain and the cross-compilation targets +RUN --network=default \ + rustup toolchain install && \ + rustup target add \ + x86_64-unknown-linux-gnu \ + aarch64-unknown-linux-gnu # Install pinned versions of cargo-auditable # Network access: to fetch dependencies @@ -87,14 +118,6 @@ RUN --network=default \ cargo install --locked \ cargo-auditable@=${CARGO_AUDITABLE_VERSION} -# Install all cross-compilation targets -# Network access: to download the targets -RUN --network=default \ - rustup target add \ - --toolchain "${RUSTC_VERSION}" \ - x86_64-unknown-linux-gnu \ - aarch64-unknown-linux-gnu - RUN --network=none \ dpkg --add-architecture arm64 && \ dpkg --add-architecture amd64 @@ -120,9 +143,6 @@ ENV \ CC_x86_64_unknown_linux_gnu=x86_64-linux-gnu-gcc \ CXX_x86_64_unknown_linux_gnu=x86_64-linux-gnu-g++ -# Set the working directory -WORKDIR /app - # Copy the code COPY ./ /app ENV SQLX_OFFLINE=true @@ -134,7 +154,7 @@ ARG TARGETARCH # Network access: cargo auditable needs it RUN --network=default \ - --mount=type=cache,target=/root/.cargo/registry \ + --mount=type=cache,target=/usr/local/cargo/registry \ --mount=type=cache,target=/app/target \ RUST_TARGET=$(case "${TARGETARCH}" in \ amd64) echo "x86_64-unknown-linux-gnu" ;; \ From cb2a6f2df1f764742088331f93808f230bebf896 Mon Sep 17 00:00:00 2001 From: Quentin Gliech Date: Wed, 26 Aug 2026 11:23:44 +0200 Subject: [PATCH 3/3] Let dependabot bump the Rust toolchain The `rust-toolchain` ecosystem updates the `channel` in `rust-toolchain.toml`, which is now the only place the Rust version is written down. Weekly with the usual 14-day cooldown, so the `.1` point release has usually landed by the time the PR opens. --- .github/dependabot.yml | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 1735e4cb9..cfc0fe5aa 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,3 +1,4 @@ +# Copyright 2025, 2026 Element Creations Ltd. # Copyright 2025 New Vector Ltd. # # SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-Element-Commercial @@ -43,6 +44,17 @@ updates: cooldown: default-days: 14 + # Rust releases every six weeks; the cooldown lets the .1 point release land first. + - package-ecosystem: "rust-toolchain" + directory: "/" + labels: + - "A-Dependencies" + - "Z-Deps-Backend" + schedule: + interval: "weekly" + cooldown: + default-days: 14 + - package-ecosystem: "github-actions" directory: "/" labels: