1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
[]
# Read rust version from rust-toolchain.toml (single source of truth
# for both rustup and mise).
= ["rust"]
[]
= { = "latest", = "rustfmt,clippy" }
= "1.43.1"
# Versions are pinned (not `latest`) so a tool release can't break CI with no
# code change. Bump deliberately. (rust is intentionally left to
# rust-toolchain.toml via idiomatic_version_file_enable_tools above.)
= "4.2.0"
# Drives the out-of-tree CMake e2e scenario (e2e-cmake-out-of-tree, #394) so it
# runs on the Linux/macOS gate instead of skipping. The scenario itself is
# gnu/clang-only (`os = ["linux", "macos"]`), so cmake here is just the build
# driver on those runners.
= "4.3.4"
# Test-coverage + sccache fallback. Listed here (not as separate
# CI install actions) so the same `mise install` populates every
# tool the repo needs.
= "0.8.7"
= "0.15.0"
# Dependency policy auditing — `just audit`. cargo-deny checks RustSec
# advisories AND license/bans/sources policy (config in `deny.toml`),
# matching the kunobi-* repos' tooling. The `aqua:` backend ships prebuilt
# binaries (no from-source compile, unlike the old cargo-audit pin).
# 0.20.2: 0.19.4 intermittently segfaulted (exit 139) during teardown after
# printing all-ok results (#673).
= "0.20.2"
# GitHub Actions SHA-pinning — `just pin-actions` / `pin-actions-check`. pinact
# rewrites each `uses: owner/repo@vN` to a full commit SHA (supply-chain
# hardening) and can verify the pins in CI. Prebuilt via the `aqua:` backend.
= "4.1.0"
# NOTE: `cargo-edit` (for `just bump`) is deliberately NOT listed here. It is a
# local, maintainer-only tool used to cut a release; CI never bumps, so pinning
# it would make every `mise install` compile it from source (it pulls in gix
# etc.) for no CI benefit — and the compile is a real reliability cost (it
# flaked a rustup component download). `just bump` guards for it with an
# install hint instead.