From df2cf59f8545e857a498c9d2145ea63629dd503e Mon Sep 17 00:00:00 2001 From: Francesco Bonacci Date: Wed, 17 Jun 2026 20:20:28 -0700 Subject: [PATCH] chore(cua-driver-rs)(nix): use cargoLock.lockFile + sync Cargo.lock on bump (kill version drift) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The release bump edits only Cargo.toml's `[workspace.package] version`, leaving Cargo.lock's 9 workspace-member versions stale. Nix pinned a manual `cargoHash` that hashes the vendored lockfile, so the committed lock + hash stayed mutually consistent (and green) only by never touching the lock — a frozen-inconsistent state that detonated the instant anyone ran `cargo build`, which re-locked the members and invalidated the hash, turning every nix job red (hit on PR #1933). The drift had silently accumulated across 0.5.3 -> 0.5.6. Three changes so this can't recur: 1. package.nix uses `cargoLock.lockFile` instead of `cargoHash`. importCargoLock derives each dep's hash from the lockfile itself, so there is NO hash to hand-maintain — Cargo.lock can change freely and the build keeps working. Verified the old "apple crates unreachable from crates.io" rationale is false: apple-cf/apple-metal/objc2 are all registry crates and there are zero git deps, so no `outputHashes` are needed. 2. package.nix reads `version` from Cargo.toml's `[workspace.package]` instead of a hardcoded literal (which had drifted to 0.5.3). 3. Re-locked Cargo.lock to 0.5.6, and the bump workflow now runs `cargo update --workspace` after bump2version and folds the synced lockfile into the bump commit (moving the tag), so the manifest and lockfile ship in sync every release. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/release-bump-version.yml | 25 ++++++++++++++++++++++ libs/cua-driver/rust/Cargo.lock | 18 ++++++++-------- nix/cua-driver/package.nix | 23 +++++++++++++------- 3 files changed, 49 insertions(+), 17 deletions(-) diff --git a/.github/workflows/release-bump-version.yml b/.github/workflows/release-bump-version.yml index 4e4f26abcf..3eee5055fc 100644 --- a/.github/workflows/release-bump-version.yml +++ b/.github/workflows/release-bump-version.yml @@ -261,6 +261,31 @@ jobs: fi bump2version $CONFIG_FLAG ${{ inputs.bump_type }} + - name: Sync Cargo.lock into the cua-driver-rs bump commit + # bump2version edits only `[workspace.package] version` in Cargo.toml, + # leaving Cargo.lock's workspace-member versions stale. The next plain + # `cargo build` anyone runs then re-locks them and diverges from the + # committed lockfile — which used to break the nix build's cargoHash. + # Re-lock the members now and fold the change into the bump commit so the + # lockfile never ships out of sync with the manifest. (cargo is + # preinstalled on ubuntu runners; `--workspace` touches members only, not + # registry deps, so this never silently bumps dependencies.) + if: ${{ inputs.service == 'cua-driver-rs' }} + run: | + cd ${{ steps.package.outputs.directory }} + cargo update --workspace + if ! git diff --quiet Cargo.lock; then + TAG=$(git tag --points-at HEAD | head -1) + git add Cargo.lock + git commit --amend --no-edit + # bump2version tagged the pre-amend commit; move the tag onto the + # amended commit so the release pipeline builds the synced lockfile. + [ -n "$TAG" ] && git tag -f "$TAG" HEAD + echo "Re-locked Cargo.lock and moved tag ${TAG:-} to the amended bump commit." + else + echo "Cargo.lock already in sync; nothing to fold in." + fi + - name: Collect created tag id: collect_tags run: | diff --git a/libs/cua-driver/rust/Cargo.lock b/libs/cua-driver/rust/Cargo.lock index 5133676757..e9aed8b7cb 100644 --- a/libs/cua-driver/rust/Cargo.lock +++ b/libs/cua-driver/rust/Cargo.lock @@ -486,7 +486,7 @@ dependencies = [ [[package]] name = "cua-driver" -version = "0.5.3" +version = "0.5.6" dependencies = [ "anyhow", "async-trait", @@ -517,7 +517,7 @@ dependencies = [ [[package]] name = "cua-driver-core" -version = "0.5.3" +version = "0.5.6" dependencies = [ "anyhow", "async-trait", @@ -532,7 +532,7 @@ dependencies = [ [[package]] name = "cua-driver-uia" -version = "0.5.3" +version = "0.5.6" dependencies = [ "anyhow", "cua-driver-core", @@ -547,7 +547,7 @@ dependencies = [ [[package]] name = "cursor-overlay" -version = "0.5.3" +version = "0.5.6" dependencies = [ "anyhow", "image", @@ -787,7 +787,7 @@ checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1" [[package]] name = "focus-monitor-win" -version = "0.5.3" +version = "0.5.6" dependencies = [ "windows 0.58.0", ] @@ -1591,7 +1591,7 @@ checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd" [[package]] name = "pip-preview" -version = "0.5.3" +version = "0.5.6" dependencies = [ "anyhow", "serde_json", @@ -1617,7 +1617,7 @@ checksum = "19f132c84eca552bf34cab8ec81f1c1dcc229b811638f9d283dceabe58c5569e" [[package]] name = "platform-linux" -version = "0.5.3" +version = "0.5.6" dependencies = [ "anyhow", "async-trait", @@ -1644,7 +1644,7 @@ dependencies = [ [[package]] name = "platform-macos" -version = "0.5.3" +version = "0.5.6" dependencies = [ "anyhow", "async-trait", @@ -1677,7 +1677,7 @@ dependencies = [ [[package]] name = "platform-windows" -version = "0.5.3" +version = "0.5.6" dependencies = [ "anyhow", "async-trait", diff --git a/nix/cua-driver/package.nix b/nix/cua-driver/package.nix index e17317e415..30cb7e39f9 100644 --- a/nix/cua-driver/package.nix +++ b/nix/cua-driver/package.nix @@ -15,17 +15,24 @@ pkgs.rustPlatform.buildRustPackage { pname = "cua-driver"; - version = "0.5.3"; + # Read the version from the single source of truth (the workspace manifest + # bumpversion edits) so it can never drift from Cargo.toml the way a + # hardcoded literal silently did across 0.5.3 -> 0.5.6. + version = (pkgs.lib.importTOML "${src}/Cargo.toml").workspace.package.version; inherit src; - # Use cargoHash (fetchCargoVendor) rather than cargoLock.lockFile because - # the workspace Cargo.lock includes macOS-only crates (apple-metal, apple-cf) - # that may be unreachable from crates.io. fetchCargoVendor handles this - # gracefully via `cargo vendor`. - # Bumped when the dependency set changes (added `atspi`/zbus for native - # AT-SPI). If this mismatches, the nix build prints the expected value. - cargoHash = "sha256-ykVW0duMeoWho0qwDdu0k//cOY6HG+HsIBQF7iT0nZ0="; + # Vendor straight from the committed Cargo.lock instead of a manual cargoHash. + # `importCargoLock` derives every dependency's fixed-output hash from the + # lockfile itself, so there is NO hash to hand-maintain: Cargo.lock can change + # (a version bump, a dependency update) and the build keeps working. The old + # cargoHash approach hashed the vendored lockfile, so any Cargo.lock change — + # even a workspace-version bump the release bump leaves behind — silently + # invalidated it and turned every nix job red until someone recomputed it. + # Every dependency here is a crates.io registry crate (the macOS-only + # apple-cf/apple-metal/objc2 crates included) and there are zero git deps, so + # importCargoLock needs no `outputHashes` overrides. + cargoLock.lockFile = "${src}/Cargo.lock"; # Build only the main binary crate. The workspace also contains # platform-macos, platform-windows, cua-driver-uia, and focus-monitor-win