viirya opened a new pull request, #59:
URL: https://github.com/apache/spark-connect-gateway/pull/59
### What changes were proposed in this pull request?
Add `--locked` to every cargo command in `.github/workflows/ci.yml` that
resolves dependencies (clippy, build, test, the ignored Redis and tracing
integration tests, and the `drain_smoke` / `ha_smoke` examples), and to the
release `cargo build` in the `Dockerfile`. The e2e jobs build their image
from
the `Dockerfile`, so they are covered too. `cargo fmt` does not resolve
dependencies and is unchanged. The `cargo install` in `audit.yml` already
uses `--locked`.
### Why are the changes needed?
Without `--locked`, cargo silently re-resolves on the runner when
`Cargo.lock`
is out of date with the manifests, for example a stale dependency list in an
entry or a version that no longer satisfies a requirement. The job then
passes
with a lockfile that differs from the one committed, so a broken `Cargo.lock`
can be merged without CI noticing. This matters most for lockfile-only
changes
such as dependabot PRs and RustSec updates, where the lockfile is the entire
change.
For the `Dockerfile` it also matters for releases: without `--locked`, the
dependency versions in a published image are not guaranteed to match the
`Cargo.lock` in the source release.
### Does this PR introduce _any_ user-facing change?
No. CI and image build configuration only. Building the image now fails if
`Cargo.lock` is out of date, instead of silently updating it.
### How was this patch tested?
This PR's own CI run is the main test: every changed step runs with the new
flag. Locally, on the pinned 1.99.0 toolchain against `main`'s `Cargo.lock`:
- `cargo clippy --workspace --all-targets --locked -- -D warnings`, `cargo
build --workspace --locked`: clean.
- `cargo test --workspace --locked`: 204 passed, 0 failed.
- `cargo test -p scg-proxy --test tracing_integration --locked -- --ignored`:
passed. `cargo run -p scg-proxy --example drain_smoke --locked`: all drain
invariants passed. The Redis test and `ha_smoke` were compiled with
`--locked`; running them needs the CI Redis service.
- `Cargo.lock` was not modified by any of the above.
- Negative check: with `memchr` removed from `pulldown-cmark`'s dependency
list in `Cargo.lock`, `cargo build -p scg-genproto --locked` fails with
"cannot update the lock file ... because --locked was passed". Without
`--locked` the same build succeeds and quietly rewrites the lockfile, which
is the behavior CI has today.
### Was this patch authored or co-authored using generative AI tooling?
Yes, co-authored with Claude Code.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
