Install cargo tools with locked dependencies

.github/workflows/autopublish.yaml

@@ -28,7 +28,7 @@ jobs:
         run: rustup update --no-self-update stable
 
       - name: Install cargo-workspaces
-        run: cargo install cargo-workspaces --version "0.3.6"
+        run: cargo install --locked cargo-workspaces --version "0.3.6"
 
       - name: Publish Crates
         env:

.github/workflows/ci.yaml

@@ -50,7 +50,7 @@ jobs:
           ref: ${{ github.event.pull_request.head.sha }}
 
       - name: Install rustup-toolchain-install-master
-        run: cargo install rustup-toolchain-install-master@1.11.0
+        run: cargo install --locked rustup-toolchain-install-master@1.11.0
 
       # Install a pinned rustc commit to avoid surprises
       - name: Install Rust toolchain

.github/workflows/fuzz.yml

@@ -38,6 +38,6 @@ jobs:
 
       - name: Build fuzzers
         run: |
-          cargo install cargo-fuzz
+          cargo install --locked cargo-fuzz
           cd crates/syntax
           cargo +nightly fuzz build

.github/workflows/publish-libs.yaml

@@ -22,7 +22,7 @@ jobs:
         run: rustup update --no-self-update stable
 
       - name: Install cargo-workspaces
-        run: cargo install cargo-workspaces --version "0.3.6"
+        run: cargo install --locked cargo-workspaces --version "0.3.6"
 
       - name: Publish Crates
         env:

docs/book/README.md

@@ -7,7 +7,7 @@ The rust analyzer manual uses [mdbook](https://rust-lang.github.io/mdBook/).
 To run the documentation site locally:
 
 ```bash
-cargo install mdbook
+cargo install --locked mdbook
 cargo xtask codegen
 cd docs/book
 mdbook serve

xtask/src/main.rs

@@ -72,7 +72,7 @@ fn run_fuzzer(sh: &Shell) -> anyhow::Result<()> {
     let _d = sh.push_dir("./crates/syntax");
     let _e = sh.push_env("RUSTUP_TOOLCHAIN", "nightly");
     if cmd!(sh, "cargo fuzz --help").read().is_err() {
-        cmd!(sh, "cargo install cargo-fuzz").run()?;
+        cmd!(sh, "cargo install --locked cargo-fuzz").run()?;
     };
 
     // Expecting nightly rustc