Adds cargo's min-publish-age policy

- uses nightly for cargo fmt / update
- uses stable for builds
- add --locked to our builds
- add workflow to check for age violations

Author: JasonVranek

.cargo/config.toml

@@ -0,0 +1,14 @@
+# Supply-chain cooldown for dependency resolution (unstable min-publish-age,
+# tracking issue rust-lang/cargo#17009): crate versions published less than
+# 14 days ago are excluded when the resolver runs on a nightly cargo.
+# Stable cargo ignores these tables silently, so builds from the committed
+# Cargo.lock are unaffected; run `just update` to resolve under the policy.
+# When the feature stabilizes, drop the [unstable] table and the nightly
+# resolver pin in the justfile: the policy then binds all resolution.
+# The fmt nightly (older than the feature) prints an unused-key warning
+# for these tables; harmless.
+[unstable]
+min-publish-age = true
+
+[registry]
+global-min-publish-age = "14 days"

.github/workflows/ci.yml

@@ -24,10 +24,10 @@ jobs:
           key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
 
       - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@master
+        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1
         with:
           toolchain: nightly-2026-01-01
-          components: clippy, rustfmt
+          components: rustfmt
 
       - name: Install protoc
         run: sudo provisioning/protoc.sh
@@ -41,7 +41,7 @@ jobs:
         run: echo "$HOME/.cargo/bin" >> $GITHUB_PATH
 
       - name: Check compilation
-        run: cargo check
+        run: cargo check --locked
 
       - name: Check formatting
         run: just fmt-check

.github/workflows/release.yml

@@ -207,7 +207,7 @@ jobs:
             ${{ runner.os }}-cargo-build-
 
       - name: Build binary (Darwin)
-        run: cargo build --release --target ${{ matrix.target }} --bin ${{ matrix.name }}
+        run: cargo build --locked --release --target ${{ matrix.target }} --bin ${{ matrix.name }}
 
       - name: Package binary (Darwin)
         run: |

.github/workflows/security-audit.yml

@@ -22,4 +22,21 @@ jobs:
       - uses: taiki-e/install-action@43aecc8d72668fbcfe75c31400bc4f890f1c5853 # v2.83.2
         with:
           tool: cargo-audit
-      - run: cargo audit
+      - run: cargo audit
+      # Stable cargo ignores the publish-age policy, so the lockfile can pin
+      # too-young crates (or deliberately via `just update-allow`); surface them.
+      - name: Check lockfile against the publish-age cooldown
+        continue-on-error: true
+        run: |
+          rustup toolchain install nightly-2026-06-21 --profile minimal
+          if ! cargo +nightly-2026-06-21 update --dry-run -Z min-publish-age > cooldown.txt 2>&1; then
+            msg=$(head -20 cooldown.txt | sed ':a;N;$!ba;s/\n/%0A/g')  # %0A = newline in annotations
+            echo "::warning title=Publish-age cooldown probe failed::$msg"
+            exit 0
+          fi
+          hits=$(grep -E "Downgrading|is too new" cooldown.txt || true)
+          if [ -n "$hits" ]; then
+            count=$(echo "$hits" | wc -l)
+            msg=$(echo "$hits" | head -20 | sed ':a;N;$!ba;s/\n/%0A/g')
+            echo "::warning title=Lockfile pins $count crate(s) younger than the publish-age cooldown::$msg"
+          fi

examples/da_commit/Dockerfile

@@ -8,12 +8,12 @@ RUN cargo chef prepare --recipe-path recipe.json
 FROM chef AS builder 
 COPY --from=planner /app/recipe.json recipe.json
 
-RUN cargo chef cook --release --recipe-path recipe.json
+RUN cargo chef cook --locked --release --recipe-path recipe.json
 
 RUN apt-get update && apt-get install -y protobuf-compiler
 
 COPY . .
-RUN cargo build --release --bin da_commit
+RUN cargo build --locked --release --bin da_commit
 
 
 FROM ubuntu AS runtime

examples/status_api/Dockerfile

@@ -8,12 +8,12 @@ RUN cargo chef prepare --recipe-path recipe.json
 FROM chef AS builder 
 COPY --from=planner /app/recipe.json recipe.json
 
-RUN cargo chef cook --release --recipe-path recipe.json
+RUN cargo chef cook --locked --release --recipe-path recipe.json
 
 RUN apt-get update && apt-get install -y protobuf-compiler
 
 COPY . .
-RUN cargo build --release --bin status_api
+RUN cargo build --locked --release --bin status_api
 
 
 FROM ubuntu AS runtime

justfile

@@ -1,23 +1,53 @@
-toolchain := "nightly-2026-01-01"
+# Used ONLY by fmt/fmt-check: rustfmt.toml relies on nightly-only options.
+# check/clippy/test run on stable via rust-toolchain.toml, so lints always
+# match the shipped compiler.
+fmt_toolchain := "nightly-2026-01-01"
+
+# Used ONLY to resolve dependency updates: min-publish-age needs a newer
+# nightly than the fmt pin above.
+resolver_toolchain := "nightly-2026-06-21"
+
+[doc("""
+  Update dependencies under the publish-age cooldown (.cargo/config.toml):
+  versions published less than 14 days ago are excluded from resolution.
+  Resolution done on stable (cargo add, plain cargo update) is NOT covered;
+  this recipe is the intended path for routine updates. Git dependencies
+  have no publish age and are refreshed WITHOUT any cooldown: review their
+  lockfile rev changes manually.
+""")]
+update *args:
+  rustup toolchain install {{resolver_toolchain}} > /dev/null 2>&1 &&   cargo +{{resolver_toolchain}} update -Z min-publish-age {{args}}
+
+[doc("""
+  Escape hatch for an urgent update to a version younger than the cooldown,
+  e.g. `just update-allow h2 0.4.16`. The bypass applies to the WHOLE
+  resolution of this invocation (transitive picks included), so review the
+  full Cargo.lock diff, not just the target package.
+""")]
+update-allow package version:
+  @echo "NOTE: the cooldown bypass is invocation-global; review the full Cargo.lock diff.
+  rustup toolchain install {{resolver_toolchain}} > /dev/null 2>&1 &&   CARGO_RESOLVER_INCOMPATIBLE_PUBLISH_AGE=allow   cargo +{{resolver_toolchain}} update -Z min-publish-age -p {{package}} --precise {{version}}
 
 fmt:
-  rustup toolchain install {{toolchain}} > /dev/null 2>&1 && \
-  cargo +{{toolchain}} fmt
+  rustup toolchain install {{fmt_toolchain}} > /dev/null 2>&1 && \
+  cargo +{{fmt_toolchain}} fmt
 
 fmt-check:
-  rustup toolchain install {{toolchain}} > /dev/null 2>&1 && \
-  cargo +{{toolchain}} fmt --check
+  rustup toolchain install {{fmt_toolchain}} > /dev/null 2>&1 && \
+  cargo +{{fmt_toolchain}} fmt --check
 
 clippy:
-  cargo +{{toolchain}} clippy --all-features --no-deps -- -D warnings
+  cargo clippy --locked --all-features --no-deps -- -D warnings
 
 # Everything needed to run before pushing
 checklist:
-  cargo check
+  cargo check --locked || (echo "Cargo.lock out of date: resolve with 'just update' (publish-age cooldown), not plain cargo update" && exit 1)
   just fmt
   just clippy
   just test
   cargo audit
+  @out=$(cargo +{{resolver_toolchain}} update --dry-run -Z min-publish-age 2>&1 | grep -E "Downgrading|is too new" || true); \
+  if [ -n "$out" ]; then echo "WARNING: lockfile pins crates younger than the publish-age cooldown:"; echo "$out"; fi
 
 # ===================================
 # === Build Commands for Services ===
@@ -99,7 +129,7 @@ clean:
 
 # Runs the suite of tests for all commit-boost crates.
 test:
-    cargo test --all-features
+    cargo test --locked --all-features
 
 # =====================
 # === Test Coverage ===
@@ -112,11 +142,11 @@ test:
 # If results look wrong after upgrading cargo-llvm-cov, run `just coverage-clean` first.
 # Requires: cargo install cargo-llvm-cov && rustup component add llvm-tools-preview
 coverage:
-  cargo llvm-cov --all-features --html --open
+  cargo llvm-cov --locked --all-features --html --open
 
 # Print a quick coverage summary to the terminal without opening a browser.
 coverage-summary:
-  cargo llvm-cov --all-features --summary-only
+  cargo llvm-cov --locked --all-features --summary-only
 
 # Remove all coverage instrumentation artifacts produced by cargo-llvm-cov.
 coverage-clean:
@@ -141,7 +171,7 @@ coverage-clean:
   - critcmp:         baseline diffing tool used by bench-compare
 """)]
 bench-install-tools:
-  cargo install cargo-criterion critcmp
+  cargo install --locked cargo-criterion critcmp
 
 [doc("""
   Run microbenchmarks and save results as a named baseline. Example: just bench main
@@ -151,14 +181,14 @@ bench-install-tools:
   For accurate baseline comparisons, use bench-compare instead.
 """)]
 bench baseline:
-  cargo bench --package cb-bench-micro -- --save-baseline {{baseline}}
+  cargo bench --locked --package cb-bench-micro -- --save-baseline {{baseline}}
 
 [doc("""
   Run microbenchmarks, save results as "current", then diff against a named baseline.
   Example: just bench-compare main
 """)]
 bench-compare baseline:
-  cargo bench --package cb-bench-micro -- --save-baseline current
+  cargo bench --locked --package cb-bench-micro -- --save-baseline current
   critcmp {{baseline}} current
 
 # =================

provisioning/build.Dockerfile

@@ -3,7 +3,7 @@ FROM --platform=${BUILDPLATFORM} rust:1.91-slim-bookworm AS chef
 ARG TARGETOS TARGETARCH BUILDPLATFORM TARGET_CRATE
 ENV CARGO_REGISTRIES_CRATES_IO_PROTOCOL=sparse
 WORKDIR /app
-RUN cargo install cargo-chef --locked && \
+RUN cargo install cargo-chef --version 0.1.78 --locked && \
     rm -rf $CARGO_HOME/registry/
 
 FROM --platform=${BUILDPLATFORM} chef AS planner
@@ -60,7 +60,7 @@ RUN if [ -f ${BUILD_VAR_SCRIPT} ]; then \
     fi && \
     apt update && \
     apt install -y git make libssl-dev:${TARGETARCH} zlib1g-dev:${TARGETARCH} pkg-config && \
-    cargo chef cook ${TARGET_FLAG} --release --recipe-path recipe.json
+    cargo chef cook --locked ${TARGET_FLAG} --release --recipe-path recipe.json
 
 # Get the latest Protoc since the one in the Debian repo is incredibly old
 COPY provisioning/protoc.sh provisioning/protoc.sh
@@ -79,7 +79,7 @@ RUN if [ -f ${BUILD_VAR_SCRIPT} ]; then \
       echo "No cross-compilation needed"; \
     fi && \
     export GIT_HASH=$(git rev-parse HEAD) && \
-    cargo build ${TARGET_FLAG} --release --bin ${TARGET_CRATE} && \
+    cargo build --locked ${TARGET_FLAG} --release --bin ${TARGET_CRATE} && \
     if [ ! -z "$TARGET" ]; then \
       # If we're cross-compiling, we need to move the binary out of the target dir
       mv target/${TARGET}/release/${TARGET_CRATE} target/release/${TARGET_CRATE}; \