Guardrails / rust

Rust version is declared

rust/version-declared@v1

The build names the Rust toolchain it compiles with, that toolchain is one exact release rather than a moving channel, and it is no older than the configured floor.

Id	rust/version-declared
Version	v1
Category	rust
Default severity	warning
Interpreter	python3
Timeout	30 seconds
Violations tolerated	0
Collects	rust

Collectors

This guardrail gathers nothing itself. It depends on the collectors below, which the CLI runs once per build before any check, and reads what they found out of GUARDRAIL_FACTS. A collector that collects nothing skips this guardrail rather than failing it.

Collector	Gathers	Inputs it is given
rust	The Cargo build in the project directory: the crate it declares, the Rust version and edition it asks for, every workspace member, the dependencies each manifest names with where each comes from and whether it is pinned, and the lock file beside them.	projectDir

The inputs above are this guardrail's own, passed straight through. Configuring one in buildnote.json changes what is collected, and two guardrails configured the same way share the one collection.

Configuration

{
  "guardrails": {
      "failOn": "error",
      "comment": true,
      "checks": [
          {
              "use": "rust/version-declared@v1",
              "severity": "warning",
              "with": {
                  "projectDir": ".",
                  "minVersion": "1.70"
              },
              "exemptions": []
          }
      ]
  }
}

Inputs

Input	Description	Default	Environment variable
projectDir	Directory holding the project, relative to the directory the CLI runs in.	.	GUARDRAIL_INPUT_PROJECTDIR
minVersion	Oldest Rust version accepted. A declared version below this is a violation.	1.70	GUARDRAIL_INPUT_MINVERSION

How to fix

Name the toolchain where cargo reads it, in a rust-toolchain.toml beside the manifest:

[toolchain]
channel = "1.76.0"
components = ["clippy", "rustfmt"]

A published crate can add rust-version = "1.76" under [package] as well, which is the floor it compiles at rather than the toolchain it is built with. With neither, the compiler is whichever release the runner already had, and stable is not an answer: it moves under the build, so a lint that tightened or a feature that stabilised changes the verdict on a rerun of the same commit.

More in rust

• rust/edition-floor. The package declares a Rust edition rather than falling back to the implied 2015 one, and that edition is no older than the configured floor.
• rust/lockfile-committed. The build commits Cargo.lock, so a rebuild of the same commit resolves the same crate versions.
• rust/no-git-dependencies. No manifest declares a dependency with a git source, so every crate in the build comes from a registry that versions it.

All 4 rust guardrails