From de165b10897381d481b71b3fe102bbcf056f24e0 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sat, 18 Jul 2026 06:02:47 +0000
Subject: [PATCH 1/7] Add --locked to all cargo install calls in CI and setup
 scripts

---
 .github/workflows/build.yml         | 2 +-
 .github/workflows/release.yml       | 2 +-
 .github/workflows/update-themes.yml | 2 +-
 contrib/bin/setup.sh                | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 817ee6bc..4fc2beda 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -124,7 +124,7 @@ jobs:
       - name: Install Cross
         if: matrix.cross
         run: |
-          cargo install cross
+          cargo install --locked cross
           echo "CARGO=cross" >> $GITHUB_ENV
 
       - name: Add Target
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 0eff0eab..ad9efde8 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -62,7 +62,7 @@ jobs:
           rustflags: ""
 
       - name: Install cargo-quickinstall
-        run: cargo install cargo-quickinstall
+        run: cargo install --locked cargo-quickinstall
 
       - name: Install cargo-edit
         run: cargo quickinstall --force cargo-edit
diff --git a/.github/workflows/update-themes.yml b/.github/workflows/update-themes.yml
index 9ed167c1..16ef8d9b 100644
--- a/.github/workflows/update-themes.yml
+++ b/.github/workflows/update-themes.yml
@@ -62,7 +62,7 @@ jobs:
 
       - name: Install cargo-edit
         if: steps.update-themes.outputs.updated == 'true'
-        run: cargo install cargo-edit
+        run: cargo install --locked cargo-edit
 
       - name: Update version in Cargo.toml
         if: steps.update-themes.outputs.updated == 'true'
diff --git a/contrib/bin/setup.sh b/contrib/bin/setup.sh
index a033aad1..08d6ac09 100755
--- a/contrib/bin/setup.sh
+++ b/contrib/bin/setup.sh
@@ -76,7 +76,7 @@ setup_cargo_binstall() {
     elif [ -x "$(command -v scoop)" ]; then
         scoop install cargo-binstall
     elif [ -x "$(command -v cargo)" ]; then
-        cargo install cargo-binstall
+        cargo install --locked cargo-binstall
     else
         echo "Please install cargo-binstall"
         exit 1

From 7b96fda042c0e83555ba18d1ef6b5db4d2bcac4d Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sat, 18 Jul 2026 07:09:12 +0000
Subject: [PATCH 2/7] fix: use official install script for cargo-binstall in
 setup.sh

The coverage CI job fails because cargo-binstall v1.21.0's lockfile
includes vergen@10.0.1 which requires rustc 1.95.0, but CI has
rustc 1.93.1. Using the official install script downloads a prebuilt
binary instead of compiling from source, avoiding the rustc version
mismatch.
---
 contrib/bin/setup.sh | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/contrib/bin/setup.sh b/contrib/bin/setup.sh
index 08d6ac09..eb3347c9 100755
--- a/contrib/bin/setup.sh
+++ b/contrib/bin/setup.sh
@@ -75,6 +75,8 @@ setup_cargo_binstall() {
         true
     elif [ -x "$(command -v scoop)" ]; then
         scoop install cargo-binstall
+    elif [ -x "$(command -v curl)" ]; then
+        curl -L --proto '=https' --tlsv1.2 -sSf https://raw.githubusercontent.com/cargo-bins/cargo-binstall/main/install-from-binstall-release.sh | bash
     elif [ -x "$(command -v cargo)" ]; then
         cargo install --locked cargo-binstall
     else

From 35f4f3ca6b0766a113cac8b8e67e88367cd18082 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sat, 18 Jul 2026 10:55:19 +0000
Subject: [PATCH 3/7] pin versions of all installed tools for reproducible
 builds

Pin cargo-binstall@1.21.0 (via BINSTALL_VERSION env var for the
prebuilt binary installer, and @version for cargo install fallback).

Pin all cargo binstall tool versions in setup.sh:
- cargo-audit@0.22.2
- cargo-edit@0.13.13
- cargo-outdated@0.19.0
- rustfilt@0.2.1
- taplo-cli@0.10.0
- git-cliff@2.13.1
- bat@0.26.1

Pin all cargo install tool versions in CI workflows:
- cross@0.2.5 in build.yml
- cargo-quickinstall@0.3.53 in release.yml
- cargo-edit@0.13.13 in release.yml and update-themes.yml
---
 .github/workflows/build.yml         |  2 +-
 .github/workflows/release.yml       |  4 ++--
 .github/workflows/update-themes.yml |  2 +-
 contrib/bin/setup.sh                | 21 ++++++++++++---------
 4 files changed, 16 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 4fc2beda..685b47aa 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -124,7 +124,7 @@ jobs:
       - name: Install Cross
         if: matrix.cross
         run: |
-          cargo install --locked cross
+          cargo install --locked "cross@0.2.5"
           echo "CARGO=cross" >> $GITHUB_ENV
 
       - name: Add Target
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ad9efde8..1daf7d8f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -62,10 +62,10 @@ jobs:
           rustflags: ""
 
       - name: Install cargo-quickinstall
-        run: cargo install --locked cargo-quickinstall
+        run: cargo install --locked "cargo-quickinstall@0.3.53"
 
       - name: Install cargo-edit
-        run: cargo quickinstall --force cargo-edit
+        run: cargo quickinstall --force "cargo-edit@0.13.13"
 
       - name: Update version in Cargo.toml
         id: update-version
diff --git a/.github/workflows/update-themes.yml b/.github/workflows/update-themes.yml
index 16ef8d9b..913a5043 100644
--- a/.github/workflows/update-themes.yml
+++ b/.github/workflows/update-themes.yml
@@ -62,7 +62,7 @@ jobs:
 
       - name: Install cargo-edit
         if: steps.update-themes.outputs.updated == 'true'
-        run: cargo install --locked cargo-edit
+        run: cargo install --locked "cargo-edit@0.13.13"
 
       - name: Update version in Cargo.toml
         if: steps.update-themes.outputs.updated == 'true'
diff --git a/contrib/bin/setup.sh b/contrib/bin/setup.sh
index eb3347c9..d881a8be 100755
--- a/contrib/bin/setup.sh
+++ b/contrib/bin/setup.sh
@@ -70,15 +70,18 @@ setup_cargo_nightly() {
     fi
 }
 
+CARGO_BINSTALL_VERSION="1.21.0"
+
 setup_cargo_binstall() {
     if [ -x "$(command -v cargo-binstall)" ]; then
         true
     elif [ -x "$(command -v scoop)" ]; then
         scoop install cargo-binstall
     elif [ -x "$(command -v curl)" ]; then
-        curl -L --proto '=https' --tlsv1.2 -sSf https://raw.githubusercontent.com/cargo-bins/cargo-binstall/main/install-from-binstall-release.sh | bash
+        BINSTALL_VERSION="${CARGO_BINSTALL_VERSION}" \
+            curl -L --proto '=https' --tlsv1.2 -sSf https://raw.githubusercontent.com/cargo-bins/cargo-binstall/main/install-from-binstall-release.sh | bash
     elif [ -x "$(command -v cargo)" ]; then
-        cargo install --locked cargo-binstall
+        cargo install --locked "cargo-binstall@${CARGO_BINSTALL_VERSION}"
     else
         echo "Please install cargo-binstall"
         exit 1
@@ -88,28 +91,28 @@ setup_cargo_binstall() {
 setup_cargo_audit() {
     if [ ! -x "$(command -v cargo-audit)" ]; then
         setup_cargo_binstall
-        cargo binstall cargo-audit
+        cargo binstall "cargo-audit@0.22.2"
     fi
 }
 
 setup_cargo_edit() {
     if ! cargo set-version --help >/dev/null 2>&1; then
         setup_cargo_binstall
-        cargo binstall cargo-edit
+        cargo binstall "cargo-edit@0.13.13"
     fi
 }
 
 setup_cargo_outdated() {
     if [ ! -x "$(command -v cargo-outdated)" ]; then
         setup_cargo_binstall
-        cargo binstall cargo-outdated
+        cargo binstall "cargo-outdated@0.19.0"
     fi
 }
 
 setup_rustfilt() {
     if [ ! -x "$(command -v rustfilt)" ]; then
         setup_cargo_binstall
-        cargo binstall rustfilt
+        cargo binstall "rustfilt@0.2.1"
     fi
 }
 
@@ -161,7 +164,7 @@ setup_coverage_tools() {
 setup_taplo() {
     if [ ! -x "$(command -v taplo)" ]; then
         setup_cargo_binstall
-        cargo binstall taplo-cli --locked --features lsp
+        cargo binstall "taplo-cli@0.10.0" --locked --features lsp
     fi
 }
 
@@ -207,7 +210,7 @@ setup_git_cliff() {
             sudo pacman -S git-cliff
         else
             setup_cargo_binstall
-            cargo binstall git-cliff --locked
+            cargo binstall "git-cliff@2.13.1" --locked
         fi
     fi
 }
@@ -224,7 +227,7 @@ setup_bat() {
             sudo pacman -S bat
         else
             setup_cargo_binstall
-            cargo binstall bat --locked
+            cargo binstall "bat@0.26.1" --locked
         fi
     fi
 }

From 4d824714ae1f0ab2842133f2101e00d4ac672169 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sat, 18 Jul 2026 11:18:24 +0000
Subject: [PATCH 4/7] revert setup.sh: remove version pinning, it's for local
 builds only

---
 contrib/bin/setup.sh | 21 ++++++++-------------
 1 file changed, 8 insertions(+), 13 deletions(-)

diff --git a/contrib/bin/setup.sh b/contrib/bin/setup.sh
index d881a8be..08d6ac09 100755
--- a/contrib/bin/setup.sh
+++ b/contrib/bin/setup.sh
@@ -70,18 +70,13 @@ setup_cargo_nightly() {
     fi
 }
 
-CARGO_BINSTALL_VERSION="1.21.0"
-
 setup_cargo_binstall() {
     if [ -x "$(command -v cargo-binstall)" ]; then
         true
     elif [ -x "$(command -v scoop)" ]; then
         scoop install cargo-binstall
-    elif [ -x "$(command -v curl)" ]; then
-        BINSTALL_VERSION="${CARGO_BINSTALL_VERSION}" \
-            curl -L --proto '=https' --tlsv1.2 -sSf https://raw.githubusercontent.com/cargo-bins/cargo-binstall/main/install-from-binstall-release.sh | bash
     elif [ -x "$(command -v cargo)" ]; then
-        cargo install --locked "cargo-binstall@${CARGO_BINSTALL_VERSION}"
+        cargo install --locked cargo-binstall
     else
         echo "Please install cargo-binstall"
         exit 1
@@ -91,28 +86,28 @@ setup_cargo_binstall() {
 setup_cargo_audit() {
     if [ ! -x "$(command -v cargo-audit)" ]; then
         setup_cargo_binstall
-        cargo binstall "cargo-audit@0.22.2"
+        cargo binstall cargo-audit
     fi
 }
 
 setup_cargo_edit() {
     if ! cargo set-version --help >/dev/null 2>&1; then
         setup_cargo_binstall
-        cargo binstall "cargo-edit@0.13.13"
+        cargo binstall cargo-edit
     fi
 }
 
 setup_cargo_outdated() {
     if [ ! -x "$(command -v cargo-outdated)" ]; then
         setup_cargo_binstall
-        cargo binstall "cargo-outdated@0.19.0"
+        cargo binstall cargo-outdated
     fi
 }
 
 setup_rustfilt() {
     if [ ! -x "$(command -v rustfilt)" ]; then
         setup_cargo_binstall
-        cargo binstall "rustfilt@0.2.1"
+        cargo binstall rustfilt
     fi
 }
 
@@ -164,7 +159,7 @@ setup_coverage_tools() {
 setup_taplo() {
     if [ ! -x "$(command -v taplo)" ]; then
         setup_cargo_binstall
-        cargo binstall "taplo-cli@0.10.0" --locked --features lsp
+        cargo binstall taplo-cli --locked --features lsp
     fi
 }
 
@@ -210,7 +205,7 @@ setup_git_cliff() {
             sudo pacman -S git-cliff
         else
             setup_cargo_binstall
-            cargo binstall "git-cliff@2.13.1" --locked
+            cargo binstall git-cliff --locked
         fi
     fi
 }
@@ -227,7 +222,7 @@ setup_bat() {
             sudo pacman -S bat
         else
             setup_cargo_binstall
-            cargo binstall "bat@0.26.1" --locked
+            cargo binstall bat --locked
         fi
     fi
 }

From e844f88960f46c4f744df085544d83681c89fb8c Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sat, 18 Jul 2026 11:22:20 +0000
Subject: [PATCH 5/7] add workflow to update pinned tool versions in CI

---
 .github/workflows/update-tools.yml | 123 +++++++++++++++++++++++++++++
 1 file changed, 123 insertions(+)
 create mode 100644 .github/workflows/update-tools.yml

diff --git a/.github/workflows/update-tools.yml b/.github/workflows/update-tools.yml
new file mode 100644
index 00000000..90c31e59
--- /dev/null
+++ b/.github/workflows/update-tools.yml
@@ -0,0 +1,123 @@
+name: Update pinned tool versions
+
+on:
+  schedule:
+    - cron: "00 05 * * MON" # Every Monday at 05:00 UTC
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pull-requests: write
+  actions: write
+
+defaults:
+  run:
+    shell: bash -euo pipefail {0}
+
+jobs:
+  update-tools:
+    name: Update pinned tool versions
+    runs-on: ubuntu-latest
+    steps:
+      - name: Generate GitHub App Token
+        id: generate-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          app-id: ${{ secrets.APP_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: ${{ github.event.repository.name }}
+
+      - name: Generate Auto-Merge GitHub App Token
+        id: generate-automerge-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          app-id: ${{ secrets.AUTOMERGE_APP_ID }}
+          private-key: ${{ secrets.AUTOMERGE_APP_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: ${{ github.event.repository.name }}
+
+      - name: Checkout repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          token: ${{ steps.generate-token.outputs.token }}
+
+      - name: Check for tool updates
+        id: check-updates
+        run: |
+          updates=""
+          summary=""
+
+          check_crate() {
+            local crate="$1"
+            local current="$2"
+            local latest
+            latest=$(curl -sf "https://crates.io/api/v1/crates/${crate}" | jq -r '.crate.max_stable_version')
+            if [ -z "${latest}" ] || [ "${latest}" = "null" ]; then
+              echo "::warning::Failed to fetch latest version for ${crate}"
+              return
+            fi
+            if [ "${current}" != "${latest}" ]; then
+              updates="${updates}${crate}:${current}:${latest}\n"
+              summary="${summary}- ${crate}: ${current} → ${latest}\n"
+            fi
+          }
+
+          # Extract pinned versions from workflow files
+          declare -A tool_versions
+
+          while IFS= read -r line; do
+            if [[ "${line}" =~ \"([a-z_-]+)@([0-9]+\.[0-9]+\.[0-9]+)\" ]]; then
+              crate="${BASH_REMATCH[1]}"
+              version="${BASH_REMATCH[2]}"
+              tool_versions["${crate}"]="${version}"
+            fi
+          done < <(grep -rh '@[0-9]' .github/workflows/ | grep -v 'uses:')
+
+          for crate in "${!tool_versions[@]}"; do
+            check_crate "${crate}" "${tool_versions[${crate}]}"
+          done
+
+          if [ -n "${updates}" ]; then
+            echo "has-updates=true" >> "${GITHUB_OUTPUT}"
+            echo -e "${summary}" > /tmp/update-summary.txt
+            echo -e "${updates}" > /tmp/updates.txt
+          else
+            echo "has-updates=false" >> "${GITHUB_OUTPUT}"
+          fi
+
+      - name: Apply updates
+        if: steps.check-updates.outputs.has-updates == 'true'
+        run: |
+          while IFS=: read -r crate current latest; do
+            [ -z "${crate}" ] && continue
+            echo "Updating ${crate}: ${current} → ${latest}"
+            find .github/workflows/ -name '*.yml' -exec \
+              sed -i "s|\"${crate}@${current}\"|\"${crate}@${latest}\"|g" {} +
+          done < /tmp/updates.txt
+
+      - name: Create pull request
+        if: steps.check-updates.outputs.has-updates == 'true'
+        id: create-pr
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
+        with:
+          token: ${{ steps.generate-token.outputs.token }}
+          commit-message: |
+            build(deps): update pinned tool versions
+
+            ${{ steps.check-updates.outputs.summary }}
+          branch: update-tools-${{ github.run_number }}-${{ github.run_id }}
+          title: "build(deps): update pinned tool versions"
+          body-path: /tmp/update-summary.txt
+          author: "missionis[bot] <234988995+missionis[bot]@users.noreply.github.com>"
+          committer: "missionis[bot] <234988995+missionis[bot]@users.noreply.github.com>"
+          labels: |
+            dependencies
+          delete-branch: true
+
+      - name: Enable auto-merge
+        if: steps.create-pr.outputs.pull-request-number
+        run: |
+          gh pr merge --auto -ds ${{ steps.create-pr.outputs.pull-request-number }}
+        env:
+          GH_TOKEN: ${{ steps.generate-automerge-token.outputs.token }}

From f31c728a45093443fad4fd720a63b8e73f4c976f Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sat, 18 Jul 2026 11:23:08 +0000
Subject: [PATCH 6/7] fix review comments in update-tools workflow

---
 .github/workflows/update-tools.yml | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/update-tools.yml b/.github/workflows/update-tools.yml
index 90c31e59..798f8c4b 100644
--- a/.github/workflows/update-tools.yml
+++ b/.github/workflows/update-tools.yml
@@ -67,12 +67,12 @@ jobs:
           declare -A tool_versions
 
           while IFS= read -r line; do
-            if [[ "${line}" =~ \"([a-z_-]+)@([0-9]+\.[0-9]+\.[0-9]+)\" ]]; then
+            if [[ "${line}" =~ \"([a-z0-9_-]+)@([0-9]+\.[0-9]+\.[0-9]+)\" ]]; then
               crate="${BASH_REMATCH[1]}"
               version="${BASH_REMATCH[2]}"
               tool_versions["${crate}"]="${version}"
             fi
-          done < <(grep -rh '@[0-9]' .github/workflows/ | grep -v 'uses:')
+          done < <(grep -rh '"[a-z0-9_-]*@[0-9]' .github/workflows/ | grep -v 'uses:')
 
           for crate in "${!tool_versions[@]}"; do
             check_crate "${crate}" "${tool_versions[${crate}]}"
@@ -80,6 +80,11 @@ jobs:
 
           if [ -n "${updates}" ]; then
             echo "has-updates=true" >> "${GITHUB_OUTPUT}"
+            {
+              echo 'summary<<EOF'
+              echo -e "${summary}"
+              echo 'EOF'
+            } >> "${GITHUB_OUTPUT}"
             echo -e "${summary}" > /tmp/update-summary.txt
             echo -e "${updates}" > /tmp/updates.txt
           else

From 90f118f3242ec37f44ea2bbc444803b06788c3f5 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sat, 18 Jul 2026 15:53:55 +0000
Subject: [PATCH 7/7] fix: use cargo-binstall official install script in
 setup.sh

---
 contrib/bin/setup.sh | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/contrib/bin/setup.sh b/contrib/bin/setup.sh
index 08d6ac09..eb3347c9 100755
--- a/contrib/bin/setup.sh
+++ b/contrib/bin/setup.sh
@@ -75,6 +75,8 @@ setup_cargo_binstall() {
         true
     elif [ -x "$(command -v scoop)" ]; then
         scoop install cargo-binstall
+    elif [ -x "$(command -v curl)" ]; then
+        curl -L --proto '=https' --tlsv1.2 -sSf https://raw.githubusercontent.com/cargo-bins/cargo-binstall/main/install-from-binstall-release.sh | bash
     elif [ -x "$(command -v cargo)" ]; then
         cargo install --locked cargo-binstall
     else