Pin cargo-binstall and cargo-about and cross-reference all tool version pins (#4505)

* Pin cargo-binstall and cargo-about and cross-reference all tool version pins * Pin the cargo-binstall GitHub Action to its release tag * Use a version floor for cargo-about and drop the Nix sync notices
2026-09-15 14:18:04 +08:00 · 2026-09-05 17:09:47 -07:00
parent 4d9a626df2
commit 23c7a96a94
6 changed files with 38 additions and 12 deletions
--- a/.devcontainer/devcontainer.json
+++ b/.devcontainer/devcontainer.json
@@ -5,10 +5,22 @@
 			"profile": "default",
 			"targets": "wasm32-unknown-unknown"
 		},
-		"ghcr.io/devcontainers/features/node:1": {}
+		"ghcr.io/devcontainers/features/node:1": {
+			// NOTICE: keep in sync with `.nvmrc`
+			"version": "24"
+		}
+	},
+	// NOTICE: keep these tool versions in sync with `.github/workflows/build.yml`, `.nix/dev.nix` and `.nix/pkgs/graphite.nix` (wasm-bindgen-cli), `tools/cargo-run/src/requirements.rs` (wasm-bindgen-cli, cargo-about), `tools/cargo-run/src/requirements/wasm_opt.rs` (Binaryen), and the `wasm-bindgen` crate in `Cargo.toml`
+	"containerEnv": {
+		"WASM_BINDGEN_CLI_VERSION": "0.2.121",
+		"CARGO_ABOUT_VERSION": "0.9.2",
+		"BINARYEN_VERSION": "130",
+		"CARGO_BINSTALL_VERSION": "1.23.0"
+	},
+	"onCreateCommand": {
+		"Install cargo-about and wasm-bindgen-cli": "curl -sSfL https://github.com/cargo-bins/cargo-binstall/releases/download/v$CARGO_BINSTALL_VERSION/cargo-binstall-$(uname -m)-unknown-linux-musl.tgz | tar xz -C $CARGO_HOME/bin && BINSTALL_DISABLE_TELEMETRY=true cargo binstall --no-confirm cargo-about@$CARGO_ABOUT_VERSION wasm-bindgen-cli@$WASM_BINDGEN_CLI_VERSION",
+		"Install Binaryen wasm-opt": "curl -sSfL https://github.com/WebAssembly/binaryen/releases/download/version_$BINARYEN_VERSION/binaryen-version_$BINARYEN_VERSION-$(uname -m)-linux.tar.gz | tar xz -C $CARGO_HOME/bin --strip-components=2 binaryen-version_$BINARYEN_VERSION/bin/wasm-opt"
 	},
-	// NOTE: Keep this in sync with WASM_BINDGEN_CLI_VERSION and CARGO_ABOUT_VERSION in `.github/workflows/build.yml`
-	"onCreateCommand": "curl -L --proto '=https' --tlsv1.2 -sSf https://raw.githubusercontent.com/cargo-bins/cargo-binstall/main/install-from-binstall-release.sh | bash && cargo binstall --no-confirm --force cargo-about@0.9.0 wasm-bindgen-cli@0.2.121",
 	"customizations": {
 		"vscode": {
 			// NOTE: Keep this in sync with `.vscode/extensions.json`
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -58,6 +58,7 @@ jobs:
      RUSTC_WRAPPER: /usr/bin/sccache
      CARGO_INCREMENTAL: 0
      SCCACHE_DIR: /var/lib/github-actions/.cache
+      # NOTICE: keep these tool versions in sync with the other jobs in this file, `.devcontainer/devcontainer.json`, `.nix/dev.nix` and `.nix/pkgs/graphite.nix` (wasm-bindgen-cli), `tools/cargo-run/src/requirements.rs` (wasm-bindgen-cli, cargo-about), `tools/cargo-run/src/requirements/wasm_opt.rs` (Binaryen), and the `wasm-bindgen` crate in `Cargo.toml`
      WASM_BINDGEN_CLI_VERSION: "0.2.121"
      BINARYEN_VERSION: "130"
    steps:
@@ -302,9 +303,11 @@ jobs:
      pull-requests: write

    env:
+      # NOTICE: keep these tool versions in sync with the other jobs in this file, `.devcontainer/devcontainer.json`, `.nix/dev.nix` and `.nix/pkgs/graphite.nix` (wasm-bindgen-cli), `tools/cargo-run/src/requirements.rs` (wasm-bindgen-cli, cargo-about), `tools/cargo-run/src/requirements/wasm_opt.rs` (Binaryen), and the `wasm-bindgen` crate in `Cargo.toml`
      WASM_BINDGEN_CLI_VERSION: "0.2.121"
      BINARYEN_VERSION: "130"
-      CARGO_ABOUT_VERSION: "0.9.0"
+      CARGO_ABOUT_VERSION: "0.9.2"
+      CARGO_BINSTALL_VERSION: "1.23.0"

    steps:
      - name: 📥 Clone repository
@@ -341,7 +344,9 @@ jobs:
            frontend/package-lock.json

      - name: 📦 Install Cargo-binstall
-        uses: cargo-bins/cargo-binstall@main
+        uses: cargo-bins/cargo-binstall@v1.23.0
+        with:
+          version: ${{ env.CARGO_BINSTALL_VERSION }}

      - name: 🚧 Install native dependencies
        shell: pwsh
@@ -497,9 +502,11 @@ jobs:
      pull-requests: write

    env:
+      # NOTICE: keep these tool versions in sync with the other jobs in this file, `.devcontainer/devcontainer.json`, `.nix/dev.nix` and `.nix/pkgs/graphite.nix` (wasm-bindgen-cli), `tools/cargo-run/src/requirements.rs` (wasm-bindgen-cli, cargo-about), `tools/cargo-run/src/requirements/wasm_opt.rs` (Binaryen), and the `wasm-bindgen` crate in `Cargo.toml`
      WASM_BINDGEN_CLI_VERSION: "0.2.121"
      BINARYEN_VERSION: "130"
-      CARGO_ABOUT_VERSION: "0.9.0"
+      CARGO_ABOUT_VERSION: "0.9.2"
+      CARGO_BINSTALL_VERSION: "1.23.0"

    steps:
      - name: 📥 Clone repository
@@ -535,6 +542,11 @@ jobs:
            package-lock.json
            frontend/package-lock.json

+      - name: 📦 Install Cargo-binstall
+        uses: cargo-bins/cargo-binstall@v1.23.0
+        with:
+          version: ${{ env.CARGO_BINSTALL_VERSION }}
+
      - name: 🚧 Install native dependencies
        env:
          GITHUB_TOKEN: ${{ github.token }}
@@ -544,8 +556,7 @@ jobs:
          brew install \
            pkg-config \
            openssl@3 \
-            llvm \
-            cargo-binstall
+            llvm

          echo "OPENSSL_DIR=$(brew --prefix openssl@3)" >> $GITHUB_ENV
          echo "PKG_CONFIG_PATH=$(brew --prefix openssl@3)/lib/pkgconfig" >> $GITHUB_ENV
--- a/.gitignore
+++ b/.gitignore
@@ -13,4 +13,4 @@ flamegraph.svg
 .direnv
 .DS_Store
 .nvim.lua
-devcontainer-lock.json
+/.devcontainer/devcontainer-lock.json
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -140,7 +140,7 @@ wgpu = { version = "29.0", features = [
 	"strict_asserts",
 ] }
 once_cell = "1.13" # Remove and replace with `core::cell::LazyCell` (<https://doc.rust-lang.org/core/cell/struct.LazyCell.html>)
-wasm-bindgen = "=0.2.121" # NOTICE: keep in sync with the `wasm-bindgen-cli` version pinned across CI workflows, devcontainer, Nix, and the `cargo-run` tool. We pin this version because wasm-bindgen upgrades may break various things.
+wasm-bindgen = "=0.2.121" # NOTICE: keep in sync with the `wasm-bindgen-cli` version pinned in `.github/workflows/build.yml`, `.devcontainer/devcontainer.json`, `.nix/dev.nix`, `.nix/pkgs/graphite.nix`, and `tools/cargo-run/src/requirements.rs`. We pin this version because wasm-bindgen upgrades may break various things.
 wasm-bindgen-futures = "0.4"
 js-sys = "=0.3.98"
 web-sys = { version = "=0.3.98", features = [
--- a/tools/cargo-run/src/requirements.rs
+++ b/tools/cargo-run/src/requirements.rs
@@ -54,6 +54,7 @@ fn requirements(task: &Task) -> Vec<Requirement> {
 			command: "wasm-bindgen",
 			args: &["--version"],
 			name: "Wasm Bindgen",
+			// NOTICE: keep in sync with the `wasm-bindgen` crate in `Cargo.toml` and the `wasm-bindgen-cli` version pinned in `.github/workflows/build.yml`, `.devcontainer/devcontainer.json`, `.nix/dev.nix`, and `.nix/pkgs/graphite.nix`
 			version: Some("=0.2.121"),
 			install: "cargo install -f wasm-bindgen-cli@0.2.121".into(),
 			skip: Some(&|task| matches!(task.target, Target::Cli)),
@@ -63,7 +64,9 @@ fn requirements(task: &Task) -> Vec<Requirement> {
 			command: "cargo-about",
 			args: &["--version"],
 			name: "Cargo About",
-			install: "cargo install cargo-about".into(),
+			// NOTICE: keep in sync with the `cargo-about` version pinned in `.github/workflows/build.yml` and `.devcontainer/devcontainer.json`
+			version: Some(">=0.9.2"),
+			install: "cargo install -f cargo-about@0.9.2".into(),
 			skip: Some(&|task| matches!(task.target, Target::Cli)),
 			..Default::default()
 		},
--- a/tools/cargo-run/src/requirements/wasm_opt.rs
+++ b/tools/cargo-run/src/requirements/wasm_opt.rs
@@ -3,7 +3,7 @@ use crate::cmd::prelude::*;
 use crate::{install_dir, workspace_dir};

 /// Pinned Binaryen release used by [`install_action`].
-/// NOTICE: keep in sync with the `BINARYEN_VERSION` pinned across the CI workflows, and update [`SHA256`] below.
+/// NOTICE: keep in sync with the Binaryen version pinned in `.github/workflows/build.yml` and `.devcontainer/devcontainer.json`, and update [`SHA256`] below.
 const VERSION: &str = "130";
 const SHA256: &[(&str, &str)] = &[
 	("x86_64-windows", "cc09c874f4332d00aa32ab72745a9b98c9a172f795762f21d03e70638a3f7f4c"),