Use gix manifest rust-version in all MSRV checks

This makes the `rust-version` in the manifest file for the `gix`
crate the single source of truth for the MSRV. CI checks use this
rather than relying on a separate copy of the MSRV. The MSRV badge
still hard-codes the MSRV (in four places in its SVG code), but a
recipe is added to regenerate it based on the MSRV, and a CI check
is added to verify that it agrees with the MSRV.

Specifically, the changes are:

1. Add an `msrv` recipe to the `justfile` that extracts the MSRV
   from the value of `rust-version` in the `gix` package, using
   `cargo metadata` and `jq`, and that formats it in the X.Y.Z
   form (since that form is slightly more widely usable than the
   X.Y form even when Z is 0).

2. Remove the hard-coded MSRV in `msrv.yml` (in `env.RUST_VERSION`)
   and instead have the `check-msrv` job in `msrv.yml` get it from
   the `gix` manifest by callig `just msrv`. This fixes the problem
   that it was possible to forget to update the MSRV in the
   workflow.

3. Replace the `ci-check-msrv` recipe in the `justfile` with a
   `check-rust-version` recipe taking a `rust-version` argument.
   Instead of implicitly using the current default toolchain and
   relying on that being the MSRV, this explicitly runs its `rustc`
   and `cargo` commands with the specified `rust-version`. The
   `check-msrv` CI job now calls this, passing the MSRV.

   The reason to have a `check-rust-version` recipe instead of a
   `check-msrv` recipe (or both recipes with the latter delegating
   to the former) is that CI usage, as well as other anticipated
   usage, involves performing additional operations between finding
   out the MSRV and attempting to build with it:

   - At least on CI, it is clearer to install the needed toolchains
     before using them, even though specifying them explicitly in
     `rustc` or `cargo` commands will try to install them.

   - More importantly, on CI and locally, the `check-rust-version`
     recipe is not currently expected to work with the MSRV when
     the committed version of `Cargo.lock` is used, because some
     locked dependencies may have later MSRVs.

     Depending on precisely what one is testing, one could
     temporarily remove `Cargo.lock` and regenerate it using the
     MSRV toolchain, or (as done on CI) temporarily
     downgrade the versions in `Cargo.lock`.

4. Add an `msrv-badge` recipe to the `justfile` that regenerates
   the MSRV badge `etc/msrv-badge.yml` based on the MSRV from the
   `gix` manifest, as obtained via `just msrv`.

   This uses a template file, added alongside the badge, where each
   place where the MSRV should appear has a literal placeholder
   `{MSRV}` instead. `just msrv-badge` copies the template, with
   the actual MSRV value subtituted for the placeholders, to the
   badge, overwriting whatever is there.

5. Add a `check-msrv-badge` job to `msrv.yml` that checks out the
   code, runs `just msrv-badge`, and checks if there are any
   changes. If so, the committed badge is out of date.

6. Add an `msrv-pass` job to `msrv.yml` that depends on the
   `check-msrv` and `check-msrv-badge` jobs. This is analogous to
   the `tests-pass` job in `ci.yml`. It is so that, if having the
   MSRV badge out of date should block PR auto-merge, then that
   can be achieved without `msrv.yml` having to contribute more
   than one required check to the branch protection rules.

(This also temporarily adds a `check-msrv` job for `macos-15`, but
that is just to verify that recent `justfile` changes are portable.
It will be removed shortly.)

Author: EliahKagan

.github/workflows/ci.yml

@@ -487,7 +487,7 @@ jobs:
           sort -m blocking-jobs.txt expected-nonblocking-jobs.txt |
             diff --color=always -U1000 - all-jobs.txt
 
-  # Dummy job to have a stable name for the "all tests pass" requirement
+  # Dummy job to have a stable name for the "all tests pass" requirement.
   tests-pass:
     name: Tests pass
 
@@ -504,7 +504,7 @@ jobs:
       - check-packetline
       - check-blocking
 
-    if: always() # always run even if dependencies fail
+    if: always()  # Always run even if dependencies fail.
 
     runs-on: ubuntu-latest
 

.github/workflows/msrv.yml

@@ -25,25 +25,57 @@ jobs:
         os:
           - windows-2022
           - ubuntu-latest
+          - macos-15  # FIXME(portability): Remove after testing new justfile changes.
 
     runs-on: ${{ matrix.os }}
 
-    env:
-      # This is dictated by `firefox` to support the `helix` editor, but now probably effectively
-      # be controlled by `jiff`, which also aligns with `regex`.
-      # IMPORTANT: When adjusting, change all occurrences in `etc/msrv-badge.svg` as well.
-      RUST_VERSION: 1.75.0
+    defaults:
+      run:
+        shell: bash  # Use `bash` even in the Windows job.
 
     steps:
       - uses: actions/checkout@v4
       - uses: extractions/setup-just@v3
-      - name: Set up ${{ env.RUST_VERSION }} (MSRV) and nightly toolchains
-        run: rustup toolchain install ${{ env.RUST_VERSION }} nightly --profile minimal --no-self-update
-      - name: Set ${{ env.RUST_VERSION }} (MSRV) as default
-        run: rustup default ${{ env.RUST_VERSION }}
+      - name: Read the MSRV
+        run: |
+          msrv="$(just msrv)"
+          echo "MSRV=$msrv" >> "$GITHUB_ENV"
+      - name: Set up MSRV and nightly toolchains
+        run: |
+          rustup toolchain install "$MSRV" nightly --profile minimal --no-self-update
       - name: Downgrade locked dependencies to lowest allowed versions
         run: |
           # TODO(msrv): Use `cargo update --minimal-versions` when `--minimal-versions` is available.
           cargo +nightly update -Zminimal-versions
       - name: Run some `cargo build` commands on `gix`
-        run: just ci-check-msrv
+        run: just check-rust-version "$MSRV"
+
+  check-msrv-badge:
+    name: Check MSRV badge
+
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+      - uses: extractions/setup-just@v3
+      - name: Regenerate the MSRV badge
+        run: just msrv-badge
+      - name: Check for changes
+        run: git diff --exit-code
+
+  # Dummy job to have a stable name for the requirement that all MSRV tests pass.
+  msrv-pass:
+    name: MSRV checks pass
+
+    needs: [ check-msrv, check-msrv-badge ]
+
+    if: always()  # Always run even if dependencies fail.
+
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Fail if ANY dependency has failed or cancelled
+        if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
+        run: exit 1
+      - name: OK
+        run: exit 0

etc/msrv-badge.template.svg

@@ -9,6 +9,8 @@ version = "0.72.1"
 authors = ["Sebastian Thiel <sebastian.thiel@icloud.com>"]
 edition = "2021"
 include = ["src/**/*", "LICENSE-*"]
+# This MSRV is dictated by `firefox` to support the `helix` editor, but is now probably
+# effectively controlled by `jiff`, which also aligns with `regex`.
 rust-version = "1.75"
 
 [lib]

gix/Cargo.toml

@@ -187,7 +187,8 @@ unit-tests-flaky:
 # Extract cargo metadata, excluding dependencies, and query it
 [private]
 get-metadata jq-query:
-    cargo metadata --format-version 1 | jq --exit-status --raw-output -- {{ quote(jq-query) }}
+    cargo metadata --format-version 1 --no-deps | \
+        jq --exit-status --raw-output -- {{ quote(jq-query) }}
 
 # Get the path to the directory where debug binaries are created during builds
 [private]
@@ -240,16 +241,32 @@ cross-test-android: (cross-test 'armv7-linux-androideabi' '--no-default-features
 check-size:
     etc/check-package-size.sh
 
-# This assumes the current default toolchain is the Minimal Supported Rust Version and checks
-# against it. This is run on CI in `msrv.yml`, after the MSRV toolchain is installed and set as
-# default, and after dependencies in `Cargo.lock` are downgraded to the latest MSRV-compatible
-# versions. Only if those or similar steps are done first does this work to validate the MSRV.
-#
-# Check the MSRV, *if* the toolchain is set and `Cargo.lock` is downgraded (used on CI)
-ci-check-msrv:
-    rustc --version
-    cargo build --locked -p gix
-    cargo build --locked -p gix --no-default-features --features async-network-client,max-performance
+# Report the Minimum Supported Rust Version (the `rust-version` of `gix`) in X.Y.Z form
+msrv:
+    set -eu; \
+        query='.packages[] | select(.name == "gix") | .rust_version'; \
+        value="$({{ j }} get-metadata "$query")"; \
+        case "$value" in \
+        *.*.*) \
+            echo "$value" ;; \
+        *.*) \
+            echo "$value.0" ;; \
+        *) \
+            echo "No '.' in gix rust-version '$value'" >&2; \
+            exit 1 ;; \
+        esac
+
+# Regenerate the MSRV badge SVG
+msrv-badge:
+    msrv="$({{ j }} msrv)" && \
+        sed "s/{MSRV}/$msrv/g" etc/msrv-badge.template.svg >etc/msrv-badge.svg
+
+# Check if `gix` and its dependencies, as currently locked, build with `rust-version`
+check-rust-version rust-version:
+    rustc +{{ rust-version }} --version
+    cargo +{{ rust-version }} build --locked -p gix
+    cargo +{{ rust-version }} build --locked -p gix \
+        --no-default-features --features async-network-client,max-performance
 
 # Enter a nix-shell able to build on macOS
 nix-shell-macos: