fix clippy on rust 1.97 and pin the toolchain - #76
Conversation
Every open PR has been failing Rust Tests at the clippy step, dependabot's
and ours alike, including PRs that touch nothing but a Python dev
dependency. The bumps aren't the cause.
CI installs whatever the latest stable is, with no pin. Stable moved to
1.97.1, whose clippy extended manual_filter to catch this in mock.rs:
files_obj.and_then(|f| if f.is_none() { None } else { Some(f) })
That code is unchanged and has been on dev for a while. It only started
failing because the lint is new and the workflow runs -D warnings, so a
fresh lint turns into a hard error everywhere at once. Locally we were on
1.95, which is why nobody saw it coming.
Rewritten as filter(|f| !f.is_none()), which is what clippy suggests and
is behavior-identical.
The pin is the actual fix for the class of problem. rust-toolchain.toml
rather than a workflow input, so local cargo resolves to the same version
CI uses and this gets caught before pushing instead of after. Keeping
-D warnings is fine once the version is pinned, since new lints then
arrive only when someone bumps it deliberately.
Verified with 1.97.1: fmt, clippy --all-targets --all-features --locked
-D warnings, and cargo test --locked all pass.
There was a problem hiding this comment.
Confirmed the diagnosis independently, and it holds up. Checked out the branch at d9f6f12, built the vendored OpenSSL, and ran the pinned 1.97.1 locally: fmt, clippy --all-targets --all-features --locked -D warnings, and cargo test --locked all pass (7 suites, 155 lib tests, 0 failures).
The root cause is right. Every failing run going back to #63 on 2026-07-18 dies at the same src/mock.rs:841 manual_filter error, and the runners were already pulling 1.97.1 before this PR, so the dependency bumps really are innocent. Since CI builds refs/pull/N/merge, the open dependabot PRs should go green on a plain re-run once this lands, no rebase needed. Pinning in rust-toolchain.toml rather than a workflow input is the right call for exactly the reason you gave: local cargo clippy now matches CI instead of finding this after the push.
Approving the approach. One change I'd like before merge, left inline on the toolchain file: the pin currently ships to end users via the sdist. One exclude line fixes it.
| @@ -0,0 +1,4 @@ | |||
| # Pinned so new clippy lints dont break dependabot PRs | |||
| [toolchain] | |||
| channel = "1.97.1" | |||
There was a problem hiding this comment.
This pin is correct for CI, but as written it also ships to end users, and I'd like that fixed before merge.
rust-toolchain.toml is picked up by both cargo package and maturin sdist. Built the sdist from this branch and extracted it:
1.97.1-x86_64-unknown-linux-gnu (overridden by '.../blasthttp-0.9.0/rust-toolchain.toml')
PyPI has 50 wheels for 0.9.0, all manylinux/musllinux, so every macOS and Windows user builds from the sdist. For them this pin silently overrides their toolchain: rustup downloads an entire extra 1.97.1 toolchain, and anyone already on a newer stable gets quietly downgraded inside their own build. That's our CI policy leaking onto their machine.
One line in [package] in Cargo.toml closes both packaging paths:
exclude = ["rust-toolchain.toml"]Verified it drops the file from cargo package --list and from maturin sdist. maturin honors the Cargo.toml exclude, so no separate [tool.maturin] exclude is needed.
Worth noting the crates.io side is already harmless: rustup only reads a toolchain file from the cwd and its parents, never from a dependency's vendored source, so downstream crates are unaffected either way. It's specifically the sdist build path that bites.
| @@ -0,0 +1,4 @@ | |||
| # Pinned so new clippy lints dont break dependabot PRs | |||
There was a problem hiding this comment.
Nit, since you're already touching this line: dont -> don't.
Non-blocking, unlike the exclude above.
It was shipping in the packaged crate, overriding the toolchain for anyone building from source. Also fixes the comment typo.
2 participants
All open PRs are failing Rust Tests at the clippy step. The dependency bumps aren't the cause: #72 bumps
ruff, which Rust never sees, and it fails too.CI installs latest stable with no pin. Rust 1.97's clippy extended
manual_filterto catch existing code insrc/mock.rs, and the workflow runs-D warnings, so a new lint broke every branch at once. We're on 1.95 locally, which is why we didn't see it coming.Fixed the lint, and pinned the toolchain in
rust-toolchain.tomlso the next Rust release can't do this again, and so localcargo clippymatches CI.The dependabot PRs should go green on a re-run once this lands.