fix(cargo-anvil): make stable toolchains deterministic

.anvil.lock

@@ -1,15 +1,15 @@
 version = 1
 tool = "anvil"
 tool_version = "0.5.0"
-catalog_checksum = "sha256:b9e76e5dab6d2cd8cd2eaea04bd1b4457ea8839a688795981dc4cc9a415f8092"
+catalog_checksum = "sha256:bea05c54e887000f8461f5bdd8f86375fc94cd481942b6c7b8ab2674d64164c6"
 
 [[file]]
 path = ".anvil/container/Containerfile"
-checksum = "sha256:4c343282b4e773978ff29b7d39e3a0955975bf64ad3e63afe1aa53e51be42916"
+checksum = "sha256:317a2bfede7c6679750dc37a5b9828419219a86e98f8568cb9106c1460677271"
 
 [[file]]
 path = ".anvil/container/Containerfile.dockerignore"
-checksum = "sha256:359c2bd70d599ff1e5674eae2af5bb35f344f78e642da7024cfdc6efc5d345da"
+checksum = "sha256:260bc557aadb7bec22525d5c98217bed2ebcac0e3252e6697f5d4a3ca629dc34"
 
 [[file]]
 path = ".anvil/container/README.md"
@@ -21,11 +21,11 @@ checksum = "sha256:09576bca317f5a413572f6626fc052214f885589f0547ed0b0c044b92cc40
 
 [[file]]
 path = ".anvil/container/image-id.ps1"
-checksum = "sha256:8cdd2dd9cdfb037d768802e4dda7d1156f626dc711663e6bc39fbb86d1ce2e04"
+checksum = "sha256:ce553ba67b21ed670db307f7ac87c95941122ece1c0bd94b1e37b83227d1ace7"
 
 [[file]]
 path = ".anvil/container/image-id.sh"
-checksum = "sha256:b526a643e42902dd1e8acff65529fb63741760f72c14b123e9747394158faf53"
+checksum = "sha256:f71671ec0f8c2ec2e17328a5aab8172744bed6f0b3a312df2bc2bd60d6460ef6"
 
 [[file]]
 path = ".anvil/container/run-in-container.ps1"
@@ -49,15 +49,15 @@ checksum = "sha256:ff8def6c0786b6e146c4b633dfe38cb9b8ede398345516cca32bbcd558608
 
 [[file]]
 path = ".github/actions/anvil-setup/action.yml"
-checksum = "sha256:3df22c126c79170d39c515a06b597a0c20a05a5803eacd38326f0fa63bea846b"
+checksum = "sha256:259d59fb9381b5e29fe2f0a123e717ba62aaecd25955906fd943f385eca22067"
 
 [[file]]
 path = ".github/actions/anvil-setup/just-problem-matcher.json"
 checksum = "sha256:ea44d5e1a2cb1471cf2cef05eceab846d8afa45cf691be800f21fec1218da120"
 
 [[file]]
 path = ".github/workflows/anvil-pr-impl.yml"
-checksum = "sha256:518d267b6def1d2549800df52fbe32c5f0848b2b2d9c00d9480b86e07b54ee3a"
+checksum = "sha256:f69ff8d422152ec5b4e59d5905316be02ea5b054b8b16752e87aac3ae290a579"
 
 [[file]]
 path = ".github/workflows/anvil-pr.yml"
@@ -73,79 +73,79 @@ checksum = "sha256:d4d3bd645a5586e9a1cc3a5fc27e38c93e59b1e29f83ede0ccd610273eec0
 
 [[file]]
 path = "justfiles/anvil/checks/aprz.just"
-checksum = "sha256:62d8334b55b0ba3b221550037dec987d9749e773f40df6c0cd18f08164c095bf"
+checksum = "sha256:079b0bf8a3e97745d8ac1fd7986056b7787af778ef00e491786572ae5166d810"
 
 [[file]]
 path = "justfiles/anvil/checks/audit.just"
-checksum = "sha256:54abf96a320bb4b35a3c0ddf2f30b0f4a30e0673e482ca3a71242fa383536415"
+checksum = "sha256:ef33da620683628208b4c5ad51f96f5f6424fe1d56c2d0475487228b1f1aec23"
 
 [[file]]
 path = "justfiles/anvil/checks/bench.just"
-checksum = "sha256:50f04b4ea6c99df8ad7434d320f34dccdb6db6a77b83e3090e35de0ca3a15f83"
+checksum = "sha256:850793443ada2151a895ee2728e81f03da5430facde16522bcc2e0c314a28577"
 
 [[file]]
 path = "justfiles/anvil/checks/bolero.just"
-checksum = "sha256:003032f39c781851b880c1d7e63b93573f5252cca9f785b98b04dfa2e858aff3"
+checksum = "sha256:a67f556d46842487dc0f5851bb5ac634245eab6c2cfac32c6f6f0599b2ddab1d"
 
 [[file]]
 path = "justfiles/anvil/checks/careful.just"
-checksum = "sha256:bf69fadd48df96f97640ec41eade07eb2b6916800014cb277c86208efc34396b"
+checksum = "sha256:ea06cf7ebd7d5955b409db500a9ab193311af584437412d7bf0429fa70e43fac"
 
 [[file]]
 path = "justfiles/anvil/checks/cargo-hack.just"
-checksum = "sha256:681c8952690496c7d29c7bf83a5ab99c193088b05a5dc7ea3b3b0ed2400904ea"
+checksum = "sha256:4eca78f197c2cf428b693c49cf0af4afb735b9c6caa8c83a71e5f5fd312a9bc1"
 
 [[file]]
 path = "justfiles/anvil/checks/cargo-sort.just"
-checksum = "sha256:2652ae52153eebe3fdb1dfd553aa65cab84d11054d5314470d55774a92a742b3"
+checksum = "sha256:ea48b494699b6d6a71acd7070c96e28ab8b8b8ee74049de82afe922540508d75"
 
 [[file]]
 path = "justfiles/anvil/checks/clippy.just"
-checksum = "sha256:64e8f11ed1a308797e5599117ab6152d0ca3a1dfb55e6a4cfdd42d35de13e1e2"
+checksum = "sha256:945a1bf3bb1372b2bfbbfec00d520a97da56ebc5575b1e6292c421b52cc77243"
 
 [[file]]
 path = "justfiles/anvil/checks/deny.just"
-checksum = "sha256:4bb4bc0822612e2d2a43689e3f5c7f1190f59ef3db201fad7f3332725ceaef16"
+checksum = "sha256:c5604e8cb0eaa2baf4e2e2c70032d037d21873090375ffcf1ee99983965f6635"
 
 [[file]]
 path = "justfiles/anvil/checks/doc-build.just"
-checksum = "sha256:57bf3ce93d3e7b947cb203f85b572531b86706ed2437ce3098f086745bf5d111"
+checksum = "sha256:9e187f61cb1ef9d11fab2e402af8a882b77f6ed17ca332afb9ae0b1d2112e95b"
 
 [[file]]
 path = "justfiles/anvil/checks/doc-test.just"
-checksum = "sha256:e923667a5ceb376232db02ec41824d21f2fccffd041565109f7740c001c1c23d"
+checksum = "sha256:0e54c767de8e57a523a8b1b589a88ab6aca3169ac97d157c42d509d429f4b024"
 
 [[file]]
 path = "justfiles/anvil/checks/ensure-no-cyclic-deps.just"
-checksum = "sha256:7351afd07f020f04fa6c7c82d4740ef32cbb1b648550f0a5ff306af6a5d58588"
+checksum = "sha256:2d19930c33a93b49d0c9e9672a31d85e1ad4fb92faecc0fb599803139b11c18f"
 
 [[file]]
 path = "justfiles/anvil/checks/ensure-no-default-features.just"
-checksum = "sha256:25c61d31ea76c5e65b5c3caf744ddc9b49f6f9cdf9717b012d1d82cebfe555b9"
+checksum = "sha256:38e089afe176aea92c93ac6758154b206b6fc8940931035c0d059449fa824d6c"
 
 [[file]]
 path = "justfiles/anvil/checks/examples.just"
-checksum = "sha256:0e84a7b43ff07608c624ece03d46ddd58c629ebd5f6a5684f3b43b7190026e0f"
+checksum = "sha256:8d01fa3e303a9f2b768213636f12c68cc8b41932b68549239e9f10d3be43507b"
 
 [[file]]
 path = "justfiles/anvil/checks/external-types.just"
-checksum = "sha256:d003f1d82898706c136f42c3156d5ecc8f288c18f125c964b9dca1d24fa93d67"
+checksum = "sha256:7e67d90a9d8bd8cd5c8adb68baf41fdd4625bff4d425b5bf18b75baee62892a8"
 
 [[file]]
 path = "justfiles/anvil/checks/fmt.just"
 checksum = "sha256:967b68ef3ed3e0dcac2a1ea22ef92c66a7db802bda718f6e5ce39f529ed8e492"
 
 [[file]]
 path = "justfiles/anvil/checks/license-headers.just"
-checksum = "sha256:ab9ef6c3b50475ff3a8ab873b319f1ec04c456275d566ce323a76730be3ad0fc"
+checksum = "sha256:7aa0560dc9088b33e80cd55aee0a25090cbd3d3610652afd3734d0ca52ee7b47"
 
 [[file]]
 path = "justfiles/anvil/checks/llvm-cov.just"
-checksum = "sha256:689f7d5b1eaea32672f8d0b9fff0994cc03bc56fb8ef282a4286f930fc503725"
+checksum = "sha256:cb23283ac3d377b1219c904f4de93b05b437b48c93629fec617307914bba6296"
 
 [[file]]
 path = "justfiles/anvil/checks/loom.just"
-checksum = "sha256:4bf509bcca3507aafd9848ce19ea3691ab2cd77de05b344e042f3ba2c300e35b"
+checksum = "sha256:7d7cb6e9845a97be18dbe93d8b04860386dc43a5f2033816c3224aa460c5aa63"
 
 [[file]]
 path = "justfiles/anvil/checks/miri-race-coverage.just"
@@ -163,29 +163,33 @@ checksum = "sha256:c82f586402f2cb05397a40eec6fe95c7590df2cc52f0dd9da6879de085175
 path = "justfiles/anvil/checks/miri.just"
 checksum = "sha256:9e9d0cbfef1e1e1586c2af4e9c387719c2f017ea1203d326baacc3ae25df80e2"
 
+[[file]]
+path = "justfiles/anvil/checks/msrv-test.just"
+checksum = "sha256:968a0cf65a319626c3ed61f75e1d363608856664d105850be281e91f8ecf3537"
+
 [[file]]
 path = "justfiles/anvil/checks/mutants-diff.just"
-checksum = "sha256:cb9721c1cc94161ea8bc20ccd94209daa23d83d1beda9f3c0969e2031a135022"
+checksum = "sha256:7b7ae9b1c303d29cb26bc70d362b5c51e3f6fbde01bdbc442da27cf53f315018"
 
 [[file]]
 path = "justfiles/anvil/checks/mutants-full.just"
-checksum = "sha256:9792344e6696f5c63f30fdccb5ef90a3598c56adb7561cec33f074c84ce6f89b"
+checksum = "sha256:604dfb6aa2742695ff638a7d2db6811a1bcbf27da73660027baacc86b2fe1509"
 
 [[file]]
 path = "justfiles/anvil/checks/pr-title.just"
 checksum = "sha256:28734aa77526ca5c53d89a32c3e20ae6b42d2032c73ab6a1dbc9831f25cb0f76"
 
 [[file]]
 path = "justfiles/anvil/checks/readme-check.just"
-checksum = "sha256:d346399f288570066e53fd123baf05f7d4a57f17da8ee687a6d881204c5bae12"
+checksum = "sha256:ce5311a8d091bb8d9cfa631a8d5753546a240d4fca55daab4d1b1bacb7c1f2a9"
 
 [[file]]
 path = "justfiles/anvil/checks/semver-check.just"
-checksum = "sha256:1b8b67f8c054c8da03d43b746f28c20f5366996e3dea3c21cf25d04a6496a072"
+checksum = "sha256:7047eb4e98f7f1fddf6a734afd0e8b1e3b4e1747b9992a0cd4c9be5892190f2c"
 
 [[file]]
 path = "justfiles/anvil/checks/spellcheck.just"
-checksum = "sha256:8f47518b756607402a7b3652762d5d37cff5d91eecd1052053176eedd65a9958"
+checksum = "sha256:2b2063f7e494dba51f805534bce5235132be1eeabde3a118d42d87ce49d51fd6"
 
 [[file]]
 path = "justfiles/anvil/checks/udeps.just"
@@ -199,6 +203,10 @@ checksum = "sha256:cbec6450a64f800963ea5ba9d2eedfa4e90d91d441307f18d109629f84912
 path = "justfiles/anvil/groups/pr-fast.just"
 checksum = "sha256:29a219b7d8b2eaa605b0444838f05ffc7538ab8bccc43d1613c555f7562a731f"
 
+[[file]]
+path = "justfiles/anvil/groups/pr-msrv.just"
+checksum = "sha256:5c862a1c7775742377e75d6848650070d11e9ce3facd9ab304b03dbca1c4b1d2"
+
 [[file]]
 path = "justfiles/anvil/groups/pr-mutants.just"
 checksum = "sha256:19a5fb032f680eee2d2e4eca56dece0ced80ac15bd2332b8135915d884f804a1"
@@ -209,7 +217,7 @@ checksum = "sha256:9a94b6ae2d212f91d324e401ebdb2238805f3450d95d4d45df791d7f1679a
 
 [[file]]
 path = "justfiles/anvil/groups/pr-slow.just"
-checksum = "sha256:8b7c490cb6eb20c31549ef71eb75eac86ae145c8c6380ee1f590ccd81eec48ea"
+checksum = "sha256:5d8bb4b73ce14ec76477f90b754c47904054e1497471a21d3d84b0ee6a4676d0"
 
 [[file]]
 path = "justfiles/anvil/groups/pr-test.just"
@@ -237,11 +245,11 @@ checksum = "sha256:6b71379310b986e9a44000ba9d072c3f8934397a0f7fb1bf27a31a7742ca7
 
 [[file]]
 path = "justfiles/anvil/impact.just"
-checksum = "sha256:5714a138135154b91b234f6bad06ec3ade0e5780f761d631c1eca92b6010e5ad"
+checksum = "sha256:efcee10ddda4d4dd7be46a36187e5bb56c05fb069776fba377a227556bccc2eb"
 
 [[file]]
 path = "justfiles/anvil/mod.just"
-checksum = "sha256:76ded6ee071fc3ba1b2b38ca97c0b2d15ab75db20ceda44c57436e5cd249ae0b"
+checksum = "sha256:c3f88aa70698bb7b9c911d395293f2d66cbb84bd2df0e9a04faec0a6cb183564"
 
 [[file]]
 path = "justfiles/anvil/runner.just"
@@ -253,11 +261,11 @@ checksum = "sha256:5b2d91569f3fe87cd5f516623a01b5c7ae855ad587870ef9a2ae6d5619dd9
 
 [[file]]
 path = "justfiles/anvil/tools.just"
-checksum = "sha256:a1e44ca16f172b487afa3997f102512733d3b65a4418cf894cbd749a3abc17dc"
+checksum = "sha256:a7ce0dfe39a65b44aa3a7d605f8819673012600b16822ae29c90e95a3b7e708a"
 
 [[file]]
 path = "justfiles/anvil/versions.just"
-checksum = "sha256:acbea93d5117db747537f4f7b9a5eb90b7d3e0dd3e8684cc0e4dc1dcb15ac93e"
+checksum = "sha256:2e6f224497a5b4ea68ab096bafc65622faf9c846c5c8caf7ea68c76e72a791c1"
 
 [[region]]
 host = ".delta.toml"

.anvil/container/Containerfile

@@ -49,10 +49,6 @@ RUN curl --proto '=https' --tlsv1.2 -fsSLo /tmp/rustup-init \
 
 WORKDIR /opt/anvil
 COPY . .
-RUN test -f rust-toolchain.toml || { \
-        echo "anvil-container requires rust-toolchain.toml" >&2; \
-        exit 1; \
-    }
 RUN --mount=type=cache,id=anvil-cargo-registry,target=/usr/local/cargo/registry \
     --mount=type=cache,id=anvil-cargo-git,target=/usr/local/cargo/git \
     --mount=type=cache,id=anvil-cargo-target,target=/tmp/anvil-target \

.anvil/container/Containerfile.dockerignore

@@ -16,6 +16,8 @@
 # contract in the allow-list too, at every depth, because a deeper candidate
 # always has an ancestor of exactly that shape.
 **
+!Cargo.toml
+!rust-toolchain
 !rust-toolchain.toml
 !justfiles/anvil/*.just
 !justfiles/anvil/checks/*.just

.anvil/container/image-id.ps1

@@ -13,12 +13,11 @@ if ($LASTEXITCODE -ne 0 -or -not $repoRoot) {
     throw 'anvil-container must run from a Git repository.'
 }
 
-$inputs = @(
-    'rust-toolchain.toml'
-)
-$toolchainPath = Join-Path $repoRoot 'rust-toolchain.toml'
-if (-not (Test-Path -LiteralPath $toolchainPath -PathType Leaf)) {
-    throw 'anvil-container requires a repository-owned rust-toolchain.toml.'
+$inputs = @('Cargo.toml')
+foreach ($toolchainFile in @('rust-toolchain', 'rust-toolchain.toml')) {
+    if (Test-Path -LiteralPath (Join-Path $repoRoot $toolchainFile) -PathType Leaf) {
+        $inputs += $toolchainFile
+    }
 }
 $containerPath = Join-Path $repoRoot '.anvil/container'
 $containerRecipe = 'justfiles/anvil/container.just'

.anvil/container/image-id.sh

@@ -7,12 +7,6 @@ if ! repo_root="$(git rev-parse --show-toplevel 2>/dev/null)"; then
     exit 1
 fi
 
-toolchain_path="$repo_root/rust-toolchain.toml"
-if [[ ! -f "$toolchain_path" ]]; then
-    echo 'anvil-container requires a repository-owned rust-toolchain.toml.' >&2
-    exit 1
-fi
-
 container_dir="$repo_root/.anvil/container"
 container_recipe="justfiles/anvil/container.just"
 default_base_image="$(sed -n 's/^ARG BASE_IMAGE=//p' "$container_dir/Containerfile" | head -n 1)"
@@ -25,7 +19,12 @@ if [[ ! "$base_image" =~ @sha256:[0-9a-fA-F]{64}$ ]]; then
     echo 'anvil-container: ANVIL_CONTAINER_BASE_IMAGE must be pinned by sha256 digest (image@sha256:<64 hex characters>).' >&2
     exit 1
 fi
-inputs=(rust-toolchain.toml)
+inputs=(Cargo.toml)
+for toolchain_file in rust-toolchain rust-toolchain.toml; do
+    if [[ -f "$repo_root/$toolchain_file" ]]; then
+        inputs+=("$toolchain_file")
+    fi
+done
 while IFS= read -r path; do
     relative="${path#"$repo_root"/}"
     # The container entry recipe drives execution on the host; it is not

.github/actions/anvil-setup/action.yml

@@ -77,9 +77,29 @@ runs:
         }
         "Free after cleanup (GiB): $(Get-FreeDiskGiB)"
 
-    - id: rustc-version
+    # Stable provisioning is part of the generated Just setup graph, so
+    # bootstrap Just before asking it for the selected compiler version.
+    # cargo-binstall keeps this cold path fast.
+    - name: Install cargo-binstall
+      uses: cargo-bins/cargo-binstall@v1.21.0 # immutable release, the tag cannot be moved
+
+    - name: Install just
       shell: bash
-      run: echo "version=$(rustc --version | awk '{print $2}')" >> "$GITHUB_OUTPUT"
+      run: |
+        if ! command -v just >/dev/null 2>&1 ; then
+          cargo binstall --no-confirm --locked just || cargo install --locked just
+        fi
+
+    - name: Provision stable toolchain and capture version
+      id: rustc-version
+      shell: pwsh -NoProfile -Command ". '{0}'"
+      run: |
+        $version = (& just _anvil-stable-rustc-version | Select-Object -Last 1)
+        if ($LASTEXITCODE -ne 0 -or [string]::IsNullOrWhiteSpace($version)) {
+          throw 'anvil: failed to provision the selected stable toolchain'
+        }
+        $version = $version.Trim()
+        "version=$version" | Out-File -FilePath $env:GITHUB_OUTPUT -Encoding utf8 -Append
     - name: Restore cargo cache
       id: cargo-cache
       uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
@@ -100,9 +120,9 @@ runs:
         # the save -- leaving the cache empty forever. The restore-keys
         # fall back across jobs so the install work is still shared
         # across sibling legs on subsequent runs.
-        key: anvil-v1-${{ runner.os }}-${{ runner.arch }}-rust${{ steps.rustc-version.outputs.version }}-${{ hashFiles('Cargo.lock', '.cargo/config.toml', 'rust-toolchain.toml', 'justfiles/anvil/versions.just') }}-${{ github.job }}
+        key: anvil-v1-${{ runner.os }}-${{ runner.arch }}-rust${{ steps.rustc-version.outputs.version }}-${{ hashFiles('Cargo.toml', 'Cargo.lock', '.cargo/config.toml', 'rust-toolchain', 'rust-toolchain.toml', 'justfiles/anvil/versions.just') }}-${{ github.job }}
         restore-keys: |
-          anvil-v1-${{ runner.os }}-${{ runner.arch }}-rust${{ steps.rustc-version.outputs.version }}-${{ hashFiles('Cargo.lock', '.cargo/config.toml', 'rust-toolchain.toml', 'justfiles/anvil/versions.just') }}-
+          anvil-v1-${{ runner.os }}-${{ runner.arch }}-rust${{ steps.rustc-version.outputs.version }}-${{ hashFiles('Cargo.toml', 'Cargo.lock', '.cargo/config.toml', 'rust-toolchain', 'rust-toolchain.toml', 'justfiles/anvil/versions.just') }}-
           anvil-v1-${{ runner.os }}-${{ runner.arch }}-rust${{ steps.rustc-version.outputs.version }}-
           anvil-v1-${{ runner.os }}-${{ runner.arch }}-
         # `.crates.toml` and `.crates2.json` track which cargo-installed
@@ -126,41 +146,11 @@ runs:
           ~/.cargo/.crates.toml
           ~/.cargo/.crates2.json
 
-    # rustup auto-installs the toolchain from rust-toolchain.toml on
-    # first cargo invocation, but it doesn't pull profile/component
-    # extras. The `anvil-setup` recipe in step "Install anvil
-    # toolchains + tools" below handles that exhaustively (the
-    # per-component install recipes in tools.just install
-    # default-toolchain components and pinned-nightly components for
-    # miri/careful/etc.) -- we don't add components inline here anymore.
-    # This step exists only to ensure rustup itself has the default
-    # toolchain set up so subsequent cargo / just calls work.
-    - name: Ensure default toolchain is installed
-      shell: bash
-      run: rustup show active-toolchain || rustup default stable
-
     # The catalog recipe `anvil-setup` (or `anvil-<group>-setup`
-    # when a group is specified via the `group` input) needs `just` to
-    # run. We bootstrap just here (chicken-and-egg), then hand off
-    # everything else to it. The setup recipes are idempotent and
+    # when a group is specified via the `group` input) uses the Just
+    # bootstrapped above, then handles everything else. The setup recipes are idempotent and
     # short-circuit on tools already installed at or above the pinned
     # version, so re-running on cache-hit runs is cheap.
-    # Install a prebuilt cargo-binstall binary in seconds. Without this,
-    # the first `_install-tool` recipe that needs binstall bootstraps it
-    # via `cargo install --locked cargo-binstall`, which takes ~4 min of
-    # source compilation on every cold-cache job. The official action
-    # downloads the release binary from cargo-bins/cargo-binstall, so
-    # the bootstrap branch in `tools.just` becomes a no-op on GH.
-    - name: Install cargo-binstall
-      uses: cargo-bins/cargo-binstall@v1.21.0 # immutable release, the tag cannot be moved
-
-    - name: Install just
-      shell: bash
-      run: |
-        if ! command -v just >/dev/null 2>&1 ; then
-          cargo binstall --no-confirm --locked just || cargo install --locked just
-        fi
-
     - name: Install anvil toolchains + tools
       shell: bash
       # Carry action data through the environment instead of interpolating it