Install cargo tools with locked dependencies

.github/workflows/ci.yml

@@ -232,7 +232,7 @@ jobs:
       - name: Install nightly toolchain
         run: rustup toolchain install nightly --profile minimal
       - name: Install rustup-toolchain-install-master
-        run: cargo install -f rustup-toolchain-install-master
+        run: cargo install --locked -f rustup-toolchain-install-master
       # Create a token for the next step so it can create a PR that actually runs CI.
       - uses: actions/create-github-app-token@v3
         id: app-token

.github/workflows/setup/action.yml

@@ -38,7 +38,7 @@ runs:
 
       - name: Install the tools we need
         if: steps.cache.outputs.cache-hit != 'true'
-        run: cargo install -f rustup-toolchain-install-master hyperfine
+        run: cargo install --locked -f rustup-toolchain-install-master hyperfine
         shell: bash
 
       - name: Install "master" toolchain

.github/workflows/sysroots.yml

@@ -20,7 +20,7 @@ jobs:
       - name: Build the sysroots
         run: |
           rustup toolchain install nightly
-          cargo install -f rustup-toolchain-install-master
+          cargo install --locked -f rustup-toolchain-install-master
           ./miri toolchain -c rust-docs # Docs are the only place targets are separated by tier
           ./miri install
           python3 -m pip install beautifulsoup4

.gitpod.yml

@@ -3,7 +3,7 @@ image: ubuntu:latest
 tasks:
   - before: echo "..."
     init: |
-      cargo install rustup-toolchain-install-master
+      cargo install --locked rustup-toolchain-install-master
       ./miri toolchain
       ./miri build
     command: echo "Run tests with ./miri test"

CONTRIBUTING.md

@@ -252,7 +252,7 @@ and on macOS, `rm -rf ~/Library/Caches/org.rust-lang.miri`).
 
 Miri comes with a few benchmarks; you can run `./miri bench` to run them with the locally built
 Miri. Note: this will run `./miri install` as a side-effect. Also requires `hyperfine` to be
-installed (`cargo install hyperfine`).
+installed (`cargo install --locked hyperfine`).
 
 To compare the benchmark results with a baseline, do the following:
 - Before applying your changes, run `./miri bench --save-baseline=baseline.json`.

miri-script/src/commands.rs

@@ -158,7 +158,7 @@ impl Command {
 
         cmd!(sh, "rustup-toolchain-install-master -n miri -c cargo -c rust-src -c rustc-dev -c llvm-tools -c rustfmt -c clippy {flags...} -- {new_commit}")
             .run()
-            .context("Failed to run rustup-toolchain-install-master. If it is not installed, run 'cargo install rustup-toolchain-install-master'.")?;
+            .context("Failed to run rustup-toolchain-install-master. If it is not installed, run 'cargo install --locked rustup-toolchain-install-master'.")?;
         cmd!(sh, "rustup override set miri").run()?;
         // Cleanup.
         cmd!(sh, "cargo clean").run()?;