chore(cua-driver-rs)(nix): cargoLock.lockFile + sync Cargo.lock on bump (kill version drift)

.github/workflows/release-bump-version.yml

@@ -261,6 +261,31 @@ jobs:
           fi
           bump2version $CONFIG_FLAG ${{ inputs.bump_type }}
 
+      - name: Sync Cargo.lock into the cua-driver-rs bump commit
+        # bump2version edits only `[workspace.package] version` in Cargo.toml,
+        # leaving Cargo.lock's workspace-member versions stale. The next plain
+        # `cargo build` anyone runs then re-locks them and diverges from the
+        # committed lockfile — which used to break the nix build's cargoHash.
+        # Re-lock the members now and fold the change into the bump commit so the
+        # lockfile never ships out of sync with the manifest. (cargo is
+        # preinstalled on ubuntu runners; `--workspace` touches members only, not
+        # registry deps, so this never silently bumps dependencies.)
+        if: ${{ inputs.service == 'cua-driver-rs' }}
+        run: |
+          cd ${{ steps.package.outputs.directory }}
+          cargo update --workspace
+          if ! git diff --quiet Cargo.lock; then
+            TAG=$(git tag --points-at HEAD | head -1)
+            git add Cargo.lock
+            git commit --amend --no-edit
+            # bump2version tagged the pre-amend commit; move the tag onto the
+            # amended commit so the release pipeline builds the synced lockfile.
+            [ -n "$TAG" ] && git tag -f "$TAG" HEAD
+            echo "Re-locked Cargo.lock and moved tag ${TAG:-<none>} to the amended bump commit."
+          else
+            echo "Cargo.lock already in sync; nothing to fold in."
+          fi
+
       - name: Collect created tag
         id: collect_tags
         run: |

nix/cua-driver/package.nix

@@ -15,17 +15,24 @@
 
 pkgs.rustPlatform.buildRustPackage {
   pname = "cua-driver";
-  version = "0.5.3";
+  # Read the version from the single source of truth (the workspace manifest
+  # bumpversion edits) so it can never drift from Cargo.toml the way a
+  # hardcoded literal silently did across 0.5.3 -> 0.5.6.
+  version = (pkgs.lib.importTOML "${src}/Cargo.toml").workspace.package.version;
 
   inherit src;
 
-  # Use cargoHash (fetchCargoVendor) rather than cargoLock.lockFile because
-  # the workspace Cargo.lock includes macOS-only crates (apple-metal, apple-cf)
-  # that may be unreachable from crates.io. fetchCargoVendor handles this
-  # gracefully via `cargo vendor`.
-  # Bumped when the dependency set changes (added `atspi`/zbus for native
-  # AT-SPI). If this mismatches, the nix build prints the expected value.
-  cargoHash = "sha256-ykVW0duMeoWho0qwDdu0k//cOY6HG+HsIBQF7iT0nZ0=";
+  # Vendor straight from the committed Cargo.lock instead of a manual cargoHash.
+  # `importCargoLock` derives every dependency's fixed-output hash from the
+  # lockfile itself, so there is NO hash to hand-maintain: Cargo.lock can change
+  # (a version bump, a dependency update) and the build keeps working. The old
+  # cargoHash approach hashed the vendored lockfile, so any Cargo.lock change —
+  # even a workspace-version bump the release bump leaves behind — silently
+  # invalidated it and turned every nix job red until someone recomputed it.
+  # Every dependency here is a crates.io registry crate (the macOS-only
+  # apple-cf/apple-metal/objc2 crates included) and there are zero git deps, so
+  # importCargoLock needs no `outputHashes` overrides.
+  cargoLock.lockFile = "${src}/Cargo.lock";
 
   # Build only the main binary crate. The workspace also contains
   # platform-macos, platform-windows, cua-driver-uia, and focus-monitor-win