Pin toolchain to a fixed channel and add an enforced lint gate - #9
Merged
Conversation
rust-toolchain.toml floated on "stable", so the pinned toolchain silently retoolchains on every stable release. Pin it to a fixed channel with an append-only bump-log comment, joining the workspace-wide toolchain sweep. Add .github/workflows/lint.yml with two jobs (format, clippy) that install the toolchain from rust-toolchain.toml (no separate toolchain input, so the version lives in exactly one place) and run cargo clippy --all-targets -- -D warnings and cargo fmt --all --check as real gates. crates.yml's existing clippy/fmt steps are left as-is (advisory clippy, no -D warnings) with a one-line pointer comment to the new enforced gate. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AGVLyRZNEKKBSfBDJfbY3V
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: serverGenReqId_75ea3aa9-a014-45dc-b27d-f5e9851b2dd4) |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
AdaWorldAPI
marked this pull request as ready for review
September 5, 2026 20:05
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
Two failures on the first CI run of this PR, one of which is not this
PR's and one of which is.
Every `ubuntu-latest / <crate> / 1.97` job failed with
error: rustc 1.97.1 is not supported by the following package:
ndarray@0.17.2 requires rustc 1.98
That is not the toolchain file this PR touched. The matrix derives its
Rust version from `Cargo.toml`'s own `rust-version` and exports it as
`RUSTUP_TOOLCHAIN`, which overrides `rust-toolchain.toml` entirely --
so those jobs ran on 1.97 before and after this PR alike. What changed
is upstream: this workspace patches `ndarray` from the fork's master
branch, and that fork just raised its own declared MSRV to 1.98. Every
consumer still declaring 1.97 goes red the moment it resolves. Bumping
`rust-version` here is the same toolchain move this PR already makes,
applied to the file CI actually reads.
The zizmor audit is this PR's. The workflow used floating action tags
and left checkout credentials persisted, against the repo's blanket
policy. Rewritten in the repo's own idiom instead: the two actions it
still needs are pinned to the same commits the existing workflows use,
checkout sets `persist-credentials: false`, and the toolchain comes
from `rustup show` reading `rust-toolchain.toml` -- which drops the
third-party toolchain action altogether and keeps the version in one
place.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AGVLyRZNEKKBSfBDJfbY3V
The MSRV declaration in Cargo.toml carries a standing instruction to keep this badge in sync; the previous commit moved the floor to 1.98 and left the badge behind. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AGVLyRZNEKKBSfBDJfbY3V
Nine findings, and the enumeration is complete: a local run of the same command the gate uses reports nothing else across the workspace. Seven are code. Six are needless borrows on `Some(&x.name.as_str())`, where the reference is created and immediately dereferenced again. The seventh is `chunks_exact_mut(4)` in the accurate-exponential reduction, rewritten as `as_chunks_mut::<4>()`, which also retires the `into_remainder()` dance: the remainder now falls out of the same call that produces the chunks. Two are argument counts, and both are allowed rather than refactored. In the hardware benchmark the arguments ARE the benchmarked shape, and in the recurrent-operator test helper they are the layer's own inputs. Grouping either set into a struct would name the same values one indirection away and make the call sites harder to read, not easier. Each allow carries that reason. Verified with the gate's own commands: `cargo clippy --all-targets -- -D warnings` and `cargo fmt --all -- --check`, both clean. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AGVLyRZNEKKBSfBDJfbY3V
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
rust-toolchain.tomlfloated onchannel = "stable", so the pinned toolchain silently retoolchains on every stable release. Pinned to a fixed channel with an append-only bump-log comment, joining the workspace-wide toolchain sweep. A future bump edits only thechannelline..github/workflows/lint.yml— two jobs (format,clippy), bothubuntu-latest, triggered onpull_requestandpushtomain, with a cancellingconcurrencygroup andpermissions: contents: read. Both install the toolchain viaactions-rust-lang/setup-rust-toolchain@v1with notoolchain:input, so the version is read fromrust-toolchain.tomland lives in exactly one place.clippyrunscargo clippy --all-targets -- -D warnings(real gate, not advisory) withSwatinem/rust-cache@v2;formatrunscargo fmt --all --check.crates.ymlis otherwise untouched — its existing clippy/fmt steps are left exactly as they were (advisory clippy, no-D warnings), with a one-line comment each pointing at the new enforced gate.Verification
cargo fmt --all --checkrun locally: clean, exit 0.cargo clippy/cargo check/cargo buildlocally — disk on this box has ~8.9 GB free and tract's full dependency tree would exhaust it. The workflow's own CI run on this PR is the verification for the clippy gate.Fallback posture
If the
clippyjob comes back red on this PR due to pre-existing upstream warnings, the follow-up is this workspace's existing tiered posture —continue-on-error: trueon the clippy step plus a named tech-debt line — never a mass auto-fix sweep of upstream code. Deliberately not pre-weakened here; landing it as a hard-D warningsgate first and softening only if evidence (a red run) says so.Test plan
lint / formatandlint / clippyjobs both report their actual result (green or a real, addressable red — not a workflow syntax failure).crates.yml's existing jobs are unaffected (diff is comment-only there).🤖 Generated with Claude Code
https://claude.ai/code/session_01AGVLyRZNEKKBSfBDJfbY3V
Generated by Claude Code