[giswqs]

Summary

The scheduled Fuzz workflow has failed every night since at least 8 November, from two causes, neither of them a fuzzing finding (so no issue was opened):

• The fuzz jobs got stable Rust. build(deps): update dtolnay/rust-toolchain requirement to b725eda525362e7cf34af9a7243cac1e3f01a7ec #1530 moved the dtolnay/rust-toolchain pin in the fuzz job from the action's nightly branch to b725eda, the commit of its stable branch that every other workflow pins; the # nightly comment stayed. cargo-fuzz passes -Zsanitizer=address, so all nine targets stopped at error: the option 'Z' is only accepted on the nightly compiler. The job now pins the same commit and asks for toolchain: nightly by name, so Dependabot can keep moving the pin without changing the toolchain.
• fuzz/Cargo.lock was out of date. rustgis-render has depended on subsetter (and through it rustc-hash) since feat(render): embed real fonts in a layout's vector PDF (#1815, part 1) #1828, and the fuzz crate's own lock file didn't list them, so cargo deny --locked in the "Fuzz crate licences and format" job refused it. The lock file gains those two packages; nothing else in it moves.

Testing

• On main, cargo metadata --manifest-path fuzz/Cargo.toml --locked fails with cannot update the lock file; on this branch it passes.
• cargo deny --manifest-path fuzz/Cargo.toml --locked check licenses sources gives licenses ok, sources ok, and cargo fmt --manifest-path fuzz/Cargo.toml --check passes.
• The workflow run by hand on this branch (gh workflow run fuzz.yml --ref fix/fuzz-nightly-toolchain -f seconds=60) is the proof for the toolchain; its result is in a comment below.

UI evidence

No visible UI change.

Related issue

None. Nothing checks fuzz/Cargo.lock on a pull request, so it can go stale again when a workspace crate gains a dependency (it did before in #1754); a check for that is left out of this fix.

Summary by CodeRabbit

• Chores
  • Updated the automated fuzz-testing workflow’s Rust toolchain configuration. Fuzz targets continue to run with nightly Rust, with no change to application behavior.
  • No user-facing features or fixes are included in this change.

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

The fuzz workflow now uses the pinned stable Rust toolchain action with toolchain: nightly. The fuzz target continues to run with nightly Rust.

Changes: Fuzz workflow

Layer / File(s)	Summary
Configure the fuzz toolchain .github/workflows/fuzz.yml	The workflow uses the pinned stable toolchain action and sets its toolchain input to nightly.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Bug fix

Suggested reviewers: mavrick-f

Merge Risk: Minimal · up to ccf55

The fuzz workflow now explicitly requests the nightly Rust toolchain that the sanitizer flag needs. This is a small CI-only change with no identified merge-blocking risk.

Pre-merge checks: 4

Check name	Status	Explanation
Title check		The title names the two changes in the PR: the fuzz job now installs nightly by name, and the fuzz lock file is updated. It is specific and matches the diff summary and PR objectives. It is a single l…
Description check		The description covers the Summary, Testing, and UI evidence sections, and the Summary explains the two causes and the fixes. The Testing section gives commands and results. UI evidence correctly says…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Title check

Explanation

The title names the two changes in the PR: the fuzz job now installs nightly by name, and the fuzz lock file is updated. It is specific and matches the diff summary and PR objectives. It is a single line and avoids vague terms.

Full details: Description check

Explanation

The description covers the Summary, Testing, and UI evidence sections, and the Summary explains the two causes and the fixes. The Testing section gives commands and results. UI evidence correctly says there is no visible UI change. The Related issue section says 'None' and explains why no issue exists. The template's section headings are all present. The description is complete and specific.

Finishing Touches

Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the nightly run,
The pinned action gets its cue.
Rust hops along the fuzzing path,
With toolchain set to nightly blue.
One workflow change, then off we go,
And carrots wait when tests are through.}

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 03d43b36-b319-4c87-8744-5b0530790d70

Commits

Reviewing files that changed from the base of the PR and between ce0c6c6 and ccf555f.

Files ignored due to path filters: 1

• fuzz/Cargo.lock is excluded by !**/*.lock

Files selected for processing: 1

• .github/workflows/fuzz.yml

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 7 remain after this review.

[github-actions]

Code review

Bugs: None found. I checked the lock file against the workspace manifests. Both subsetter (0.2.6) and ttf-parser (0.25.1) match the workspace pins. rustc-hash has only one version in the lock, so the unversioned reference is unambiguous. sha2 has two versions (0.10.9 and 0.11.1), and the added sha2 0.11.1 reference is correctly disambiguated. The entries are in Cargo's sort order. The workflow change pins the same dtolnay/rust-toolchain commit that every other workflow uses, and it passes toolchain: nightly as an explicit input. Confidence: high.

Security: None found. The diff changes no executable code paths, only a CI toolchain selection and a lock file. Confidence: high.

Performance: None found. Confidence: high.

Quality:

• The PR description says the lock file gains "those two packages; nothing else in it moves." The diff also adds dependency edges that the description does not mention: sha2 0.11.1 on rustgis-data and ttf-parser on rustgis-render. Both edges are correct, since the workspace manifests declare them. The description should list them so reviewers don't assume the lock change is only subsetter and rustc-hash. The sha2 edge also means the description's account of the stale lock is incomplete. Confidence: high. This is a PR-description nit, so I have not posted it as an inline comment.

AGENTS.md: No violations found. No new dependency is added to a manifest, so the licence check and cargo xtask notices are not triggered by this diff. The workflow change is limited to CI and touches no code under crates/. Confidence: high.

Not verified: I could not run cargo --locked, cargo deny, or the fuzz workflow here. The conclusions above come from reading the lock file and workflows. The PR's own proof run is in a comment that is not in the staged context.

Inline comments: None posted. No finding met the bar for an inline comment.

Prior reviews: The review-thread file is empty, so there were no earlier concerns to skip.

Change size

Compared with main (merge base ce0c6c6 to PR head ccf555f): the whole PR, not the latest push.

Measure	Value
Files changed	2 (added 0, modified 2, removed 0, renamed 0)
Size before	112.1 KB (114,803 B)
Size after	112.8 KB (115,492 B)
Total size change	+689 B

Path	Before	After	Change
fuzz/Cargo.lock	102.5 KB	103.0 KB	+466 B
.github/workflows/fuzz.yml	9.6 KB	9.8 KB	+223 B

[github-actions]

📖 Docs preview

Item	Value
Preview	https://preview.rustgis.app/pr-1950/
Web app	https://preview.rustgis.app/pr-1950/app/
Commit	ccf555f

GitHub Pages takes a minute or two to publish a new commit.

[giswqs]

The workflow run by hand on this branch: https://github.com/opengeos/RustGIS/actions/runs/43475952194 (60 s a target). All nine targets now build on nightly and fuzz, and the licence and format job passes. Seven targets pass; sheets (2 crash inputs) and geotiff (1 out-of-memory input) fail on their Findings step, which is the fuzzer doing its job again rather than this change: those readers get their own issue.