Install cargo tools with locked dependencies

.github/workflows/ci.yml

@@ -54,9 +54,9 @@ jobs:
       - name: Install Dependencies
         if: steps.mdbook-cache.outputs.cache-hit != 'true'
         run: |
-          cargo install mdbook --version ${{ env.MDBOOK_VERSION }}
-          cargo install mdbook-linkcheck2 --version ${{ env.MDBOOK_LINKCHECK2_VERSION }}
-          cargo install mdbook-mermaid --version ${{ env.MDBOOK_MERMAID_VERSION }}
+          cargo install --locked mdbook --version ${{ env.MDBOOK_VERSION }}
+          cargo install --locked mdbook-linkcheck2 --version ${{ env.MDBOOK_LINKCHECK2_VERSION }}
+          cargo install --locked mdbook-mermaid --version ${{ env.MDBOOK_MERMAID_VERSION }}
 
       - name: Check build
         run: ENABLE_LINKCHECK=1 mdbook build

README.md

@@ -35,7 +35,7 @@ Check out the forge documentation for [our policy][forge_policy].
 To build a local static HTML site, install [`mdbook`](https://github.com/rust-lang/mdBook) with:
 
 ```
-cargo install mdbook mdbook-linkcheck2 mdbook-mermaid
+cargo install --locked mdbook mdbook-linkcheck2 mdbook-mermaid
 ```
 
 and execute the following command in the root of the repository:

src/backend/debugging.md

@@ -71,7 +71,7 @@ use the `RUSTFLAGS` environment variable (e.g. `RUSTFLAGS='--emit=llvm-ir'`).
 This causes rustc to spit out LLVM IR into the target directory.
 
 `cargo llvm-ir [options] path` spits out the LLVM IR for a particular function at `path`.
-(`cargo install cargo-asm` installs `cargo asm` and `cargo llvm-ir`).
+(`cargo install --locked cargo-asm` installs `cargo asm` and `cargo llvm-ir`).
 `--build-type=debug` emits code for debug builds.
 There are also other useful options.
 Also, debug info in LLVM IR can clutter the output a lot:

src/building/how-to-build-and-run.md

@@ -155,7 +155,7 @@ There is a binary that wraps bootstrap called `x`.
 It runs `./x`, and can be installed system-wide and run from any subdirectory of a checkout.
 It also looks up the appropriate version of Python to use and avoids depending on which shell you're currently using.
 
-You can install it with `cargo install --path src/tools/x`.
+You can install it with `cargo install --locked --path src/tools/x`.
 
 ## Create a `bootstrap.toml`
 

src/debuginfo/intro.md

@@ -86,7 +86,7 @@ accurate, and has useful diagrams.
     * [pdb-rs](https://github.com/microsoft/pdb-rs/) - A Rust-based PDB reader and writer based on
     other publicly-available information.
     Does not guarantee stability or spec compliance.
-    Also contains `pdbtool`, which can dump PDB files (`cargo install pdbtool`)
+    Also contains `pdbtool`, which can dump PDB files (`cargo install --locked pdbtool`)
     * [Debug Interface Access SDK](https://learn.microsoft.com/en-us/visualstudio/debugger/debug-interface-access/getting-started-debug-interface-access-sdk).
     While it does not document the PDB format directly, details can be gleaned from the interface
     itself.

src/profiling.md

@@ -41,7 +41,7 @@ It is stored in files with `*.no-opt.bc` extension in LLVM bitcode format.
 
 Example usage:
 ```
-cargo install cargo-llvm-lines
+cargo install --locked cargo-llvm-lines
 # On a normal crate you could now run `cargo llvm-lines`, but `x` isn't normal :P
 
 # Do a clean before every run, to not mix in the results from previous runs.

src/profiling/with-perf.md

@@ -54,7 +54,7 @@ In case to avoid the issue of `addr2line xxx/elf: could not read first record` w
 collected data from `cargo`, you may need use the latest version of `addr2line`:
 
 ```bash
-cargo install addr2line --features="bin"
+cargo install --locked addr2line --features="bin"
 ```
 
 ### Gathering a perf profile from a `perf.rust-lang.org` test
@@ -161,7 +161,7 @@ It's probably easiest to explain by walking through how I would analyze NLL perf
 You can install perf-focus using `cargo install`:
 
 ```bash
-cargo install perf-focus
+cargo install --locked perf-focus
 ```
 
 ### Example: How much time is spent in MIR borrowck?