From 371b6dd674feca36ba88e12b3e590be198f4dde4 Mon Sep 17 00:00:00 2001
From: MotherSphere <linhajahad@gmail.com>
Date: Wed, 14 Oct 2026 12:08:13 +0200
Subject: [PATCH] ci: install Rust with rustup and match the current release
 and Dependabot templates

- release.yml: re-copy the Project-Colony-Resources sign-and-publish caller
  template. The build job now installs Rust with rustup (stable, minimal
  profile, plus the matrix target) instead of the dtolnay/rust-toolchain
  pin. The sign-and-publish.yml organisation pin stays at 619460ff.
- dependabot.yml: copy the current template, whose ignore rule ends with a
  wildcard so it matches the shared signing workflow and Dependabot never
  moves the organisation pin.
- ci.yml: replace the four dtolnay/rust-toolchain steps with the rustup
  step from design/dependencies.md. The MSRV job installs the rust-version
  read from Cargo.toml (1.88); clippy and rustfmt add their component.
---
 .github/dependabot.yml        |  6 +++--
 .github/workflows/ci.yml      | 42 +++++++++++++++++++++--------------
 .github/workflows/release.yml | 16 +++++++------
 3 files changed, 38 insertions(+), 26 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 2eb6e4c..d6b1dad 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -14,9 +14,11 @@ updates:
     # The shared signing workflow stays at the organisation pin, which moves
     # for every program at once: design/releases.md in
     # Project-Colony-Resources, "The pin". A Dependabot PR would move one
-    # repository alone.
+    # repository alone. Dependabot names that dependency after the workflow
+    # path (Project-Colony/Project-Colony-Resources/.github/workflows/...), so
+    # the rule needs the trailing wildcard to match it.
     ignore:
-      - dependency-name: Project-Colony/Project-Colony-Resources
+      - dependency-name: "Project-Colony/Project-Colony-Resources*"
     groups:
       actions:
         patterns: ["*"]
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1b9f235..d2225e8 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -32,12 +32,14 @@ jobs:
         with:
           persist-credentials: false
 
-      # Pinned to master with `toolchain: stable` rather than to the `stable`
-      # branch: that branch is rebased onto every master commit, so a SHA
-      # pinned on it stops being reachable from any branch.
-      - uses: dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f # master, 2026-10-09
-        with:
-          toolchain: stable
+      # rustup is on every GitHub-hosted runner image, so there is no
+      # third-party toolchain action to pin. bash keeps the step the same on
+      # the Windows and macOS legs.
+      - name: Install Rust
+        shell: bash
+        run: |
+          rustup toolchain install stable --profile minimal --no-self-update
+          rustup default stable
 
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
 
@@ -63,9 +65,11 @@ jobs:
           echo "version=$version" >> "$GITHUB_OUTPUT"
           echo "RUSTUP_TOOLCHAIN=$version" >> "$GITHUB_ENV"
 
-      - uses: dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f # master, 2026-10-09
-        with:
-          toolchain: ${{ steps.msrv.outputs.version }}
+      - name: Install Rust
+        shell: bash
+        run: |
+          rustup toolchain install "$RUSTUP_TOOLCHAIN" --profile minimal --no-self-update
+          rustup default "$RUSTUP_TOOLCHAIN"
 
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
@@ -85,10 +89,12 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f # master, 2026-10-09
-        with:
-          toolchain: stable
-          components: clippy
+      - name: Install Rust
+        shell: bash
+        run: |
+          rustup toolchain install stable --profile minimal --no-self-update
+          rustup default stable
+          rustup component add clippy
 
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
 
@@ -103,10 +109,12 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f # master, 2026-10-09
-        with:
-          toolchain: stable
-          components: rustfmt
+      - name: Install Rust
+        shell: bash
+        run: |
+          rustup toolchain install stable --profile minimal --no-self-update
+          rustup default stable
+          rustup component add rustfmt
 
       - name: Formatting
         run: cargo fmt --check
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 0afc877..faccdef 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -120,13 +120,15 @@ jobs:
           ref: ${{ needs.release-please.outputs.tag_name || inputs.tag }}
           persist-credentials: false
 
-      # Pinned to master with `toolchain: stable` rather than to the `stable`
-      # branch: that branch is rebased onto every master commit, so a SHA
-      # pinned on it stops being reachable from any branch.
-      - uses: dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f # master, 2026-10-09
-        with:
-          toolchain: stable
-          targets: ${{ matrix.target }}
+      # rustup is on every GitHub-hosted runner image, so there is no
+      # third-party toolchain action to pin. Adding the target is a no-op on
+      # the legs that build for their own host; the Intel macOS leg needs it.
+      - name: Install Rust
+        shell: bash
+        run: |
+          rustup toolchain install stable --profile minimal --no-self-update
+          rustup default stable
+          rustup target add ${{ matrix.target }}
 
       # No build cache here: SignPath forbids release builds that reuse
       # outputs of earlier, unverified builds.