fix(anvil): avoid implicit installer auth and cache impact tools

.anvil.lock

@@ -1,15 +1,15 @@
 version = 1
 tool = "anvil"
 tool_version = "0.9.0"
-catalog_checksum = "sha256:8daaee8ac9a6ceb2c71b002ff6eb85d49057ae8df7c56f2c4c9a2805de3288bb"
+catalog_checksum = "sha256:96c5667686180202232be81717f977dbcd8c77805f21bbb022876c73e907944f"
 
 [[file]]
 path = ".anvil/container/Dockerfile.dockerignore"
 checksum = "sha256:641cb14e197a1fd9c8e179b7e992aede15d80291841b82830d7283e1b751d3cb"
 
 [[file]]
 path = ".github/actions/anvil-impact/action.yml"
-checksum = "sha256:76be01852dc1f7e01905c4a8ad384ca57eefc15e2ed74c5c00f57dddefae9b6f"
+checksum = "sha256:9c9b4fabcaa073e9a1e8a55fbb13bdfff9017afb0520ac51b9caf90a092c9b5d"
 
 [[file]]
 path = ".github/actions/anvil-report-status/action.yml"
@@ -21,7 +21,7 @@ checksum = "sha256:d564a0ce424cda58c8f5b2476cf0c8b36e759afbdf8227608bd1f3fc74913
 
 [[file]]
 path = ".github/actions/anvil-setup/action.yml"
-checksum = "sha256:08bdc66a6ee94447aa1a60ece93c73fcbc930b7e331de85b2e9b78b5bc3d2e01"
+checksum = "sha256:26ab9d71d809c0fb80e01975de9ba4d7e00c8d289063578c190b7a411c3f7027"
 
 [[file]]
 path = ".github/actions/anvil-setup/just-problem-matcher.json"
@@ -245,7 +245,7 @@ checksum = "sha256:00453a12cbb34811ee6a2c083dade5f6198575e3b0610f49e4743366326cd
 
 [[file]]
 path = "justfiles/anvil/tools.just"
-checksum = "sha256:77329a0cb72de82742e7f48b6c8c06874e13b5c1622dc8080ce003e0c5ece251"
+checksum = "sha256:2f2f45903254f40a6510ae8163003c495e71f54e705808b7a6ac9111f82564b1"
 
 [[file]]
 path = "justfiles/anvil/versions.just"

.github/actions/anvil-impact/action.yml

@@ -23,17 +23,12 @@ description: |
 runs:
   using: composite
   steps:
-    # anvil-setup with group=none bootstraps the rust toolchain +
-    # just + binstall + cache, but skips the full catalog install.
-    # We follow it with just the cargo-delta install (the only tool
-    # this composite needs). This keeps the impact stage lean -- it's
+    # Install only cargo-delta inside setup, after restore and before save.
+    # This keeps the impact stage lean -- it's
     # the critical-path gating dep for every PR-tier group job.
     - uses: ./.github/actions/anvil-setup
       with:
-        group: none
-    - name: Install cargo-delta
-      shell: bash
-      run: just anvil-tool-cargo-delta-install binstall
+        group: impact
     - name: Compute impact
       shell: bash
       # Run the shared anvil-impact recipe -- the same impact building block

.github/actions/anvil-setup/action.yml

@@ -14,8 +14,8 @@ inputs:
           `just anvil-setup` -- use for local "give me everything"
           flows.
         - "none": skip tool installation entirely; just restore the
-          Cargo cache and bootstrap just + binstall. Used by
-          anvil-impact, which installs only cargo-delta afterwards.
+          Cargo cache and bootstrap just + binstall.
+        - "impact": install only cargo-delta from source, before saving the cache.
         - a name containing only lowercase letters, digits, and hyphens:
           install only that group's prerequisites via
           `just anvil-<group>-setup`.
@@ -110,6 +110,8 @@ runs:
     # cargo-binstall keeps the cold bootstrap path fast.
     - name: Install cargo-binstall
       uses: cargo-bins/cargo-binstall@v1.21.0 # pinned by tag: this release is an immutable release (GitHub locks the tag to a commit)
+      with:
+        version: "1.21.0"
 
     - name: Install just
       shell: pwsh -NoProfile -Command ". '{0}'"
@@ -122,9 +124,9 @@ runs:
         }
         if ($null -eq $installed -or $installed -lt $minimum) {
           Write-Host "Installing just >= $minimum (installed: $(if ($installed) { $installed } else { 'not found' }))"
-          & cargo binstall --no-confirm --locked --version ">=$minimum" just
+          & cargo binstall --no-confirm --locked --no-discover-github-token --version "=$minimum" just
           if ($LASTEXITCODE -ne 0) {
-            & cargo install --locked --version ">=$minimum" just
+            & cargo install --locked --version "=$minimum" just
             if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
           }
         }
@@ -148,8 +150,9 @@ runs:
         ANVIL_GROUP: ${{ inputs.group }}
       # When `group` is empty (the default), installs the full catalog
       # via `just anvil-setup binstall`. When `group` is "none",
-      # skips tool installation entirely (used by anvil-impact, which
-      # only needs cargo-delta and installs it itself afterwards). When
+      # skips tool installation entirely. The "impact" group source-installs
+      # cargo-delta before the cache save, avoiding release discovery on
+      # the impact stage's critical path. When
       # `group` is anything else, installs only what that group needs
       # via `just anvil-<group>-setup binstall`.
       #
@@ -167,6 +170,7 @@ runs:
 
         case "$ANVIL_GROUP" in
           none) echo "anvil-setup: group=none, skipping tool install" ;;
+          impact) just anvil-tool-cargo-delta-install install ;;
           "")   just anvil-setup binstall ;;
           *)    just "anvil-$ANVIL_GROUP-setup" binstall ;;
         esac

crates/cargo-anvil/docs/design/github.md

@@ -778,8 +778,11 @@ prerequisites provision the selected compiler and tools. Its
 
 - empty (default): runs `just anvil-setup binstall` -- the full catalog. Use
   for local "give me everything" flows.
-- `none`: skips the group/full tool fan-out. Used by `anvil-impact`, which only
-  needs `cargo-delta` and installs it itself afterwards.
+- `none`: skips the group/full tool fan-out.
+- `impact`: runs `just anvil-tool-cargo-delta-install install` before saving the
+  existing Cargo cache. A cold miss builds the exact catalog pin with `--locked`;
+  a warm hit reuses the installed tool. This avoids release discovery for delta
+  in the impact stage, not because delta binaries are unavailable.
 - any other value (e.g. `pr-fast`, `scheduled-advisories`): runs
   `just anvil-<group>-setup binstall` -- only the tools, components, and
   toolchains that group actually needs. Ordinary group names contain only
@@ -798,6 +801,13 @@ The action expects the rustup proxies on `PATH` and installs a missing selected
 toolchain (see §7).
 `anvil-impact` is described in §6 below.
 
+Setup does not forward `github.token` to installers. Binstall calls disable token
+discovery from GitHub CLI and Git configuration. Explicit caller credentials are
+not removed. The later run-group step retains its existing API token scope.
+Bootstrap downloads pin cargo-binstall to 1.21.0 and Just to 1.46.0; newer installed
+Just versions remain accepted. Other groups retain binary-first installation and
+the existing prerequisite-checked source fallback for spellcheck.
+
 Its optional `free-disk-space` input defaults to `false`. When enabled on a
 GitHub-hosted runner, it removes pre-installed toolchains that anvil's Rust checks do
 not use: Android, Haskell/GHC, Swift and browser drivers on Linux; Android and
@@ -813,18 +823,17 @@ Other groups retain the action's disabled default.
 `anvil-impact` recipe — the same impact building block adopters run locally (see
 [local.md §4](./local.md#4-impact-scoping-via-the-anvil-impact-recipe)). It:
 
-1. `./.github/actions/anvil-setup` with `group: none` (bootstrap rust + just +
-   cache; no catalog tools).
-2. `just anvil-tool-cargo-delta-install binstall` -- the only tool this composite
-   needs. **This is the only job that runs cargo-delta to compute the impact
+1. `./.github/actions/anvil-setup` with `group: impact` restores Cargo home,
+   bootstraps tools, and source-installs cargo-delta before the cache save.
+   **This is the only job that runs cargo-delta to compute the impact
    set.** (Group setup jobs also install cargo-delta as a prerequisite, but in
    `consume` mode they never run it -- they read the downloaded impact cache.)
-3. `just anvil-impact`, which resolves the base ref (`_anvil-base-ref`), snapshots the
+2. `just anvil-impact`, which resolves the base ref (`_anvil-base-ref`), snapshots the
    base ref (in a throwaway worktree) and the working tree, runs
    `cargo delta impact`, and writes the durable cache under `target/anvil/impact/`:
    the per-tier `include_<tier>.txt` lists (via `_anvil-impact-format`), `impact.json`,
    and the `snapshots/`.
-4. Uploads that whole directory as the `anvil-impact-<runner.os>` artifact
+3. Uploads that whole directory as the `anvil-impact-<runner.os>` artifact
    (`actions/upload-artifact`).
 
 ### 6.1 How the impact result propagates to the group jobs

crates/cargo-anvil/docs/design/local.md

@@ -229,11 +229,9 @@ catalog edit (changing a variable in `versions.just`), not an upstream-release-t
 surprise.
 
 `cargo-binstall` and `just` are bootstrap utilities rather than catalog checks.
-When absent, setup installs the latest compatible release available at that time;
-when present, setup accepts it. They are intentionally outside the catalog's exact
-installation guarantee so the bootstrap does not recursively require a versioned
-installer. Their versions can therefore vary across cold environments, while every
-tool that determines a catalog check's verdict remains catalog-controlled.
+GitHub setup pins their downloads to cargo-binstall 1.21.0 and Just 1.46.0, while
+accepting newer installed Just versions. The local cargo-binstall source bootstrap
+continues to install the latest compatible release when the binary is absent.
 
 ### 3.2 Detecting installed versions
 
@@ -308,6 +306,10 @@ The `installer` argument:
   A successful binary path cuts the cold-runner install phase from ~30 min to ~1 min.
   `cargo-binstall` itself needs to be on PATH; the GH setup composite arranges this.
 
+Binstall calls use `--no-discover-github-token` to avoid reading credentials from
+GitHub CLI or Git configuration. Explicit token environment variables and Cargo
+registry credentials are unchanged. This is not isolation from caller credentials.
+
 The GitHub composite setup action calls `just anvil-<group>-setup binstall`
 (or just `anvil-setup binstall` when no group is scoped). The ADO setup step
 template uses the default `install` backend because cargo-binstall has unresolved

crates/cargo-anvil/src/anvil/artifacts/github.rs

@@ -254,6 +254,31 @@ mod tests {
         assert!(!SETUP_ACTION.contains("apt-get install -y libclang-dev"));
     }
 
+    #[test]
+    fn setup_avoids_implicit_installer_credentials_and_pins_bootstrap_downloads() {
+        for action in [SETUP_ACTION, IMPACT_ACTION] {
+            assert!(!action.contains("${{ github.token }}"));
+            assert!(!action.contains("Remove-Item Env:"));
+        }
+        let bootstrap = SETUP_ACTION
+            .split_once("    - name: Install just\n")
+            .unwrap()
+            .1
+            .split("\n    - name:")
+            .next()
+            .unwrap();
+        assert!(bootstrap.contains("cargo binstall --no-confirm --locked --no-discover-github-token --version \"=$minimum\" just"));
+        assert!(bootstrap.contains("cargo install --locked --version \"=$minimum\" just"));
+        let binstall = SETUP_ACTION
+            .split_once("    - name: Install cargo-binstall\n")
+            .unwrap()
+            .1
+            .split("\n    - name:")
+            .next()
+            .unwrap();
+        assert!(binstall.contains("version: \"1.21.0\""));
+    }
+
     #[test]
     fn run_group_action_captures_and_reports_results() {
         assert!(RUN_GROUP_ACTION.contains("uses: ./.github/actions/anvil-setup"));
@@ -416,14 +441,18 @@ export -f just
     }
 
     #[test]
-    fn impact_action_uses_group_none_and_runs_the_shared_recipe() {
-        // The impact action reuses anvil-setup (group=none) + the cargo-delta
+    fn impact_action_installs_delta_before_saving_and_runs_the_shared_recipe() {
+        // The impact action reuses anvil-setup (group=impact) for the cargo-delta
         // install, then runs the same `just anvil-impact` recipe adopters run
         // locally and uploads the whole cache as a per-OS artifact. The include
         // lists reach group jobs through that downloaded cache, never job
         // outputs, so CI and local execution stay identical by construction.
-        assert!(IMPACT_ACTION.contains("group: none"));
-        assert!(IMPACT_ACTION.contains("just anvil-tool-cargo-delta-install binstall"));
+        assert!(IMPACT_ACTION.contains("group: impact"));
+        assert!(!IMPACT_ACTION.contains("run: just anvil-tool-cargo-delta-install"));
+        let restore = SETUP_ACTION.find("    - name: Restore cargo cache").unwrap();
+        let install = SETUP_ACTION.find("impact) just anvil-tool-cargo-delta-install install").unwrap();
+        let save = SETUP_ACTION.find("    - name: Save cargo cache").unwrap();
+        assert!(restore < install && install < save);
         assert!(IMPACT_ACTION.contains("run: just anvil-impact"));
         assert!(IMPACT_ACTION.contains("uses: actions/upload-artifact"));
         assert!(IMPACT_ACTION.contains("name: anvil-impact-${{ runner.os }}"));

crates/cargo-anvil/templates/github/impact-action.yml

@@ -23,17 +23,12 @@ description: |
 runs:
   using: composite
   steps:
-    # anvil-setup with group=none bootstraps the rust toolchain +
-    # just + binstall + cache, but skips the full catalog install.
-    # We follow it with just the cargo-delta install (the only tool
-    # this composite needs). This keeps the impact stage lean -- it's
+    # Install only cargo-delta inside setup, after restore and before save.
+    # This keeps the impact stage lean -- it's
     # the critical-path gating dep for every PR-tier group job.
     - uses: ./.github/actions/anvil-setup
       with:
-        group: none
-    - name: Install cargo-delta
-      shell: bash
-      run: just anvil-tool-cargo-delta-install binstall
+        group: impact
     - name: Compute impact
       shell: bash
       # Run the shared anvil-impact recipe -- the same impact building block

crates/cargo-anvil/templates/github/setup-action.yml

@@ -14,8 +14,8 @@ inputs:
           `just anvil-setup` -- use for local "give me everything"
           flows.
         - "none": skip tool installation entirely; just restore the
-          Cargo cache and bootstrap just + binstall. Used by
-          anvil-impact, which installs only cargo-delta afterwards.
+          Cargo cache and bootstrap just + binstall.
+        - "impact": install only cargo-delta from source, before saving the cache.
         - a name containing only lowercase letters, digits, and hyphens:
           install only that group's prerequisites via
           `just anvil-<group>-setup`.
@@ -110,6 +110,8 @@ runs:
     # cargo-binstall keeps the cold bootstrap path fast.
     - name: Install cargo-binstall
       uses: cargo-bins/cargo-binstall@v1.21.0 # pinned by tag: this release is an immutable release (GitHub locks the tag to a commit)
+      with:
+        version: "1.21.0"
 
     - name: Install just
       shell: pwsh -NoProfile -Command ". '{0}'"
@@ -122,9 +124,9 @@ runs:
         }
         if ($null -eq $installed -or $installed -lt $minimum) {
           Write-Host "Installing just >= $minimum (installed: $(if ($installed) { $installed } else { 'not found' }))"
-          & cargo binstall --no-confirm --locked --version ">=$minimum" just
+          & cargo binstall --no-confirm --locked --no-discover-github-token --version "=$minimum" just
           if ($LASTEXITCODE -ne 0) {
-            & cargo install --locked --version ">=$minimum" just
+            & cargo install --locked --version "=$minimum" just
             if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
           }
         }
@@ -148,8 +150,9 @@ runs:
         ANVIL_GROUP: ${{ inputs.group }}
       # When `group` is empty (the default), installs the full catalog
       # via `just anvil-setup binstall`. When `group` is "none",
-      # skips tool installation entirely (used by anvil-impact, which
-      # only needs cargo-delta and installs it itself afterwards). When
+      # skips tool installation entirely. The "impact" group source-installs
+      # cargo-delta before the cache save, avoiding release discovery on
+      # the impact stage's critical path. When
       # `group` is anything else, installs only what that group needs
       # via `just anvil-<group>-setup binstall`.
       #
@@ -167,6 +170,7 @@ runs:
 
         case "$ANVIL_GROUP" in
           none) echo "anvil-setup: group=none, skipping tool install" ;;
+          impact) just anvil-tool-cargo-delta-install install ;;
           "")   just anvil-setup binstall ;;
           *)    just "anvil-$ANVIL_GROUP-setup" binstall ;;
         esac

crates/cargo-anvil/templates/justfiles/anvil/tools.just

@@ -468,6 +468,7 @@ _install-tool-core name version installer source_prereq="":
         if ($sourcePrereq) {
             $binstallArgs += @('--disable-strategies', 'compile')
         }
+        $binstallArgs += '--no-discover-github-token'
         $binstallArgs += @($name, '--version', "=$version")
         & cargo {{_anvil_stable_toolchain_args}} @binstallArgs
         if ($LASTEXITCODE -eq 0) { exit 0 }