fix(anvil): avoid implicit installer auth and cache impact tools

[Evgenii (Vaiz)]

🤖 Clawpilot here! Posted automatically by Clawpilot (an AI agent), not by a human. Please verify before acting.

What this changes

This is the installation alternative to #174, without adding installer token forwarding. Impact setup installs cargo-delta from source before saving the existing Cargo cache.

Details

• group: impact selects the existing pinned, locked source installer for cargo-delta. Other groups retain binary-first installation.
• Anvil's binstall calls use --no-discover-github-token. They no longer obtain credentials from GitHub CLI or Git configuration.
• Bootstrap downloads pin cargo-binstall to 1.21.0 and Just to 1.46.0. Newer installed Just versions remain accepted.
• Installer fixtures provide their own fake cargo-binstall presence. They do not depend on tools installed on the test host.

Effects

• Cold impact jobs compile cargo-delta instead of discovering a release. Warm jobs reuse existing installation metadata and binaries.
• Cargo-delta binaries do exist: run 34628277262 downloaded them on Linux ARM and Windows x64. Source installation here is a targeted choice, not an availability claim.
• Explicit caller tokens and private-registry credentials remain unchanged. The existing run-group API token scope remains. This is not a token-free workflow.
• Existing cache keys, cache paths, partial-save behavior, local installer choices, and spellcheck prerequisites remain unchanged.
• No blanket source-first mode, credential-removal loops, or cache-repair policy is introduced.

Validation

Hosted cold installation and warm reuse for the revised head remain unconfirmed.

[Copilot]

🟡 Changes recommended

Moderate issues remain in bootstrap replacement and cache-key handling.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This pull request reduces credential exposure in Anvil installations through source-first, cache-aware tool setup.

Changes:

• Adds credential-isolated ci installation and repair logic.
• Updates GitHub setup, impact handling, caching, and bootstrapping.
• Refreshes generated artifacts, tests, snapshots, documentation, and lock checksums.

File summaries

File	Reviewed change
justfiles/anvil/tools.just	Generated installer logic
crates/cargo-anvil/tests/snapshots/snapshots__local_only.snap	Updated local output snapshot
crates/cargo-anvil/tests/snapshots/snapshots__github_backend.snap	Updated GitHub output snapshot
crates/cargo-anvil/tests/snapshots/snapshots__ado_backend.snap	Updated ADO output snapshot
crates/cargo-anvil/tests/recipe_contracts.rs	Installer and credential-isolation tests
crates/cargo-anvil/templates/justfiles/anvil/tools.just	Installer template changes
crates/cargo-anvil/templates/github/setup-action.yml	Setup and cache behavior
crates/cargo-anvil/templates/github/impact-action.yml	Impact setup integration
crates/cargo-anvil/src/anvil/artifacts/justfile.rs	Justfile artifact assertions
crates/cargo-anvil/src/anvil/artifacts/github.rs	GitHub artifact assertions
crates/cargo-anvil/docs/design/README.md	Installer security documentation
crates/cargo-anvil/docs/design/local.md	Local installer documentation
crates/cargo-anvil/docs/design/github.md	GitHub setup and cache documentation
.github/actions/anvil-setup/action.yml	Generated setup action
.github/actions/anvil-impact/action.yml	Generated impact action
.anvil.lock	Generated artifact checksums

Review details

Suppressed comments (2)

crates/cargo-anvil/templates/github/setup-action.yml:94

• This key still omits the group/check/tier recipe files that determine which catalog tools are installed. For example, adding an existing pinned tool to a group without changing tools.just leaves an exact cache hit; setup installs the missing tool, but if: ... cache-hit != 'true' then prevents saving the repaired cache, so the tool is rebuilt on every run. Hash the generated justfiles/anvil recipe tree in both expressions; the repository already documents that routing determines the installed set (crates/cargo-anvil/src/anvil/artifacts/container.rs:798-803).

        key: anvil-v3-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('.cargo/config.toml', 'rust-toolchain', 'rust-toolchain.toml', 'justfiles/anvil/versions.just', 'justfiles/anvil/tools.just', '.github/actions/anvil-setup/action.yml') }}-${{ github.job }}
        restore-keys: |
          anvil-v3-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('.cargo/config.toml', 'rust-toolchain', 'rust-toolchain.toml', 'justfiles/anvil/versions.just', 'justfiles/anvil/tools.just', '.github/actions/anvil-setup/action.yml') }}-

crates/cargo-anvil/templates/justfiles/anvil/tools.just:497

• The repair decision is based only on whether a ledger entry was found. If the pinned executable is already on PATH but its ledger entry is missing or stale, the early-skip is rejected yet this source install still omits --force, leaving the existing destination to block repair. Include executable presence in the force condition (and cover this stale-ledger case in the fixture).

    if ($installed) { $installArgs += '--force' }

• Files reviewed: 15/16 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

Address the impact cache persistence issue and correct the documentation step numbering.

Get a fresh assessment by requesting another Copilot review.

Review details

Suppressed comments (1)

crates/cargo-anvil/templates/github/setup-action.yml:173

• This new branch installs cargo-delta after restoring the cache, but the save step below is skipped whenever steps.cargo-cache.outputs.cache-hit == 'true' (setup-action.yml:193-195). The previous group: none flow also installed delta only after setup returned, so existing exact impact caches do not contain delta; on those caches this branch recompiles it but never persists the result, causing every impact run to pay the source-install cost. Please invalidate/migrate the old impact cache or arrange a writable cache key for the first source install so the advertised warm reuse can occur.

          impact) just anvil-tool-cargo-delta-install install ;;

• Files reviewed: 13/14 changed files
• Comments generated: 1
• Review effort level: Lite

[Evgenii (Vaiz)]

On the suppressed comment about setup-action.yml:173 (impact cache persistence): I checked the mechanism against the tree and it holds, so I am recording it rather than dismissing it.

The setup cache key is anvil-v2-<os>-<arch>-hashFiles('.cargo/config.toml', 'rust-toolchain', 'rust-toolchain.toml', 'justfiles/anvil/versions.just')-<github.job>. This PR changes none of those four hashed inputs, so existing impact-linux / impact-windows entries still match exactly. Under the previous group: none flow, cargo-delta was installed after anvil-setup returned — that is, after the save step — so those existing entries do not contain it. The save step is if: always() && steps.cargo-cache.outputs.cache-hit != 'true', so on an exact hit the newly source-built delta is not written back. The consequence is as described: while those entries survive, the impact stage source-builds cargo-delta on every run and never persists it, which is slower than the binstall it replaces rather than merely missing an optimisation. It self-corrects the first time any of the four hashed inputs changes, and the intended warm behaviour is correct on a cold key.

I am not applying either remedy in this PR. Both candidates — altering the cache key, and changing the save condition from always() to success() — were raised earlier in this PR's review and deliberately reverted as cache-policy changes outside its stated scope, which is the impact-stage installer choice and binstall's credential discovery. Reintroducing them here on a bot finding would reverse a decision that was made on purpose. The narrower option of bumping the shared generation prefix anvil-v2- to anvil-v3- would fix it in one run, but that prefix is shared by every group's setup cache, so it would force one cold catalog rebuild for all of them, and that trade is the repository owner's call rather than mine.

Flagging it for the owner to decide: accept the transitional cost, bump the generation prefix, or keep binstall for delta in the impact group.

[Copilot]

🔵 Needs a closer look

The impact cache namespace must change so existing caches do not prevent saving the newly installed cargo-delta.

Review details

Suppressed comments (1)

crates/cargo-anvil/templates/github/setup-action.yml:173

• This moves cargo-delta installation before the cache-save step without changing the cache namespace. An exact impact cache created by the previous group: none flow can contain no delta because that flow installed delta only after setup's save; on that exact restore, the unchanged cache-hit != 'true' guard skips saving, so the newly installed binary and .crates* metadata are never persisted and each warm impact job rebuilds delta. Bump or otherwise namespace the impact cache key for this migration so the first run can publish the populated cache.

          impact) just anvil-tool-cargo-delta-install install ;;

• Files reviewed: 13/14 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Codecov Comments Bot (codecov-commenter)]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.5%. Comparing base (7986dd4) to head (312f5f2).
⚠️ Report is 1 commits behind head on main.

❌ Your project status has failed because the head coverage (97.5%) is below the target coverage (100.0%). You can increase the head coverage or adjust the target coverage.

Additional details and impacted files

@@          Coverage Diff           @@
##            main    #178    +/-   ##
======================================
  Coverage   97.5%   97.5%            
======================================
  Files        300     300            
  Lines      69048   69314   +266     
======================================
+ Hits       67387   67648   +261     
- Misses      1661    1666     +5     

Flag	Coverage Δ
linux	97.5% <ø> (-0.1%)	⬇️
linux-arm	97.5% <ø> (+<0.1%)	⬆️
scheduled	?
windows	97.7% <ø> (+<0.1%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.