From 73ce468bf8d0e6146036074036f51960814813c6 Mon Sep 17 00:00:00 2001
From: Leynos <leynos@troubledskies.net>
Date: Sat, 23 Aug 2025 09:52:04 +0100
Subject: [PATCH 1/4] Enforce Rust 1.89 MSRV in CI

---
 .github/workflows/ci.yml               | 9 ++++++++-
 .github/workflows/netsukefile-test.yml | 7 +++++++
 .github/workflows/release.yml          | 4 ++++
 Cargo.toml                             | 1 +
 ninja_env/Cargo.toml                   | 2 +-
 rust-toolchain.toml                    | 2 +-
 test_support/Cargo.toml                | 2 +-
 7 files changed, 23 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8a556e38..b40b37e4 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -9,15 +9,21 @@ on:
 jobs:
   build-test:
     runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        rust: [stable, '1.89.0']
     permissions:
       contents: read
     env:
       CARGO_TERM_COLOR: always
       BUILD_PROFILE: debug
+      RUSTUP_TOOLCHAIN: ${{ matrix.rust }}
     steps:
       - uses: actions/checkout@v4
       - name: Setup Rust
         uses: leynos/shared-actions/.github/actions/setup-rust@c6559452842af6a83b83429129dccaf910e34562
+        with:
+          toolchain: ${{ matrix.rust }}
       - name: Show Ninja version
         run: ninja --version
       - name: Format
@@ -27,6 +33,7 @@ jobs:
       - name: Test
         run: make test
       - name: Test and Measure Coverage
+        if: matrix.rust == 'stable'
         uses: leynos/shared-actions/.github/actions/generate-coverage@c6559452842af6a83b83429129dccaf910e34562
         with:
           output-path: lcov.info
@@ -34,7 +41,7 @@ jobs:
       - name: Upload coverage data to CodeScene
         env:
           CS_ACCESS_TOKEN: ${{ secrets.CS_ACCESS_TOKEN }}
-        if: ${{ env.CS_ACCESS_TOKEN }}
+        if: matrix.rust == 'stable' && env.CS_ACCESS_TOKEN
         uses: leynos/shared-actions/.github/actions/upload-codescene-coverage@c6559452842af6a83b83429129dccaf910e34562
         with:
           format: lcov
diff --git a/.github/workflows/netsukefile-test.yml b/.github/workflows/netsukefile-test.yml
index 3a3b29aa..27f8b838 100644
--- a/.github/workflows/netsukefile-test.yml
+++ b/.github/workflows/netsukefile-test.yml
@@ -9,13 +9,20 @@ on:
 jobs:
   netsukefile:
     runs-on: ubuntu-22.04
+    strategy:
+      matrix:
+        rust: [stable, '1.89.0']
     permissions:
       contents: read
+    env:
+      RUSTUP_TOOLCHAIN: ${{ matrix.rust }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
       - name: Setup Rust
         uses: leynos/shared-actions/.github/actions/setup-rust@c6559452842af6a83b83429129dccaf910e34562
+        with:
+          toolchain: ${{ matrix.rust }}
       - name: Cache Cargo
         uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4
         with:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 32404452..dcd145cb 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -85,6 +85,8 @@ PY
           echo "Release tag $tag matches Cargo.toml version."
       - name: Setup Rust
         uses: leynos/shared-actions/.github/actions/setup-rust@c6559452842af6a83b83429129dccaf910e34562
+      - name: Install MSRV toolchain
+        run: rustup toolchain install 1.89.0
       - name: Cache cross binary
         uses: actions/cache@v4
         with:
@@ -106,6 +108,8 @@ PY
             ${{ runner.os }}-cargo-
       - name: Add release target
         run: rustup target add ${{ matrix.target }}
+      - name: Verify MSRV build
+        run: cross +1.89.0 build --release --target ${{ matrix.target }}
       - name: Build release binary
         run: cross +stable build --release --target ${{ matrix.target }}
       - name: Prepare artifact
diff --git a/Cargo.toml b/Cargo.toml
index 7a929fbe..19dea0ff 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -2,6 +2,7 @@
 name = "netsuke"
 version = "0.1.0"
 edition = "2024"
+rust-version = "1.89.0"
 
 [dependencies]
 clap = { version = "4.5.0", features = ["derive"] }
diff --git a/ninja_env/Cargo.toml b/ninja_env/Cargo.toml
index 3b4262f9..07d1a54c 100644
--- a/ninja_env/Cargo.toml
+++ b/ninja_env/Cargo.toml
@@ -2,7 +2,7 @@
 name = "ninja_env"
 version = "0.1.0"
 edition = "2024"
-rust-version = "1.85.0"
+rust-version = "1.89.0"
 publish = false
 
 [dependencies]
diff --git a/rust-toolchain.toml b/rust-toolchain.toml
index 15373e12..908d2ecb 100644
--- a/rust-toolchain.toml
+++ b/rust-toolchain.toml
@@ -1,3 +1,3 @@
 [toolchain]
-channel = "nightly-2025-06-26"
+channel = "1.89.0"
 components = ["rustfmt", "clippy"]
diff --git a/test_support/Cargo.toml b/test_support/Cargo.toml
index 81a6553d..dbba76e3 100644
--- a/test_support/Cargo.toml
+++ b/test_support/Cargo.toml
@@ -2,7 +2,7 @@
 name = "test_support"
 version = "0.1.0"
 edition = "2024"
-rust-version = "1.85.0"
+rust-version = "1.89.0"
 publish = false
 
 [dependencies]

From 35fedba7db516d0d8579ae25d75b3af824c11830 Mon Sep 17 00:00:00 2001
From: Leynos <leynos@troubledskies.net>
Date: Sat, 23 Aug 2025 11:14:26 +0100
Subject: [PATCH 2/4] Refine MSRV testing workflows

---
 .github/workflows/ci.yml               |  3 ++-
 .github/workflows/netsukefile-test.yml |  9 +++++++-
 .github/workflows/release.yml          | 29 ++++++++++++++++----------
 3 files changed, 28 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b40b37e4..caf732c2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -10,6 +10,7 @@ jobs:
   build-test:
     runs-on: ubuntu-latest
     strategy:
+      fail-fast: false
       matrix:
         rust: [stable, '1.89.0']
     permissions:
@@ -17,13 +18,13 @@ jobs:
     env:
       CARGO_TERM_COLOR: always
       BUILD_PROFILE: debug
-      RUSTUP_TOOLCHAIN: ${{ matrix.rust }}
     steps:
       - uses: actions/checkout@v4
       - name: Setup Rust
         uses: leynos/shared-actions/.github/actions/setup-rust@c6559452842af6a83b83429129dccaf910e34562
         with:
           toolchain: ${{ matrix.rust }}
+          components: rustfmt, clippy
       - name: Show Ninja version
         run: ninja --version
       - name: Format
diff --git a/.github/workflows/netsukefile-test.yml b/.github/workflows/netsukefile-test.yml
index 27f8b838..66bf5073 100644
--- a/.github/workflows/netsukefile-test.yml
+++ b/.github/workflows/netsukefile-test.yml
@@ -10,6 +10,7 @@ jobs:
   netsukefile:
     runs-on: ubuntu-22.04
     strategy:
+      fail-fast: false
       matrix:
         rust: [stable, '1.89.0']
     permissions:
@@ -23,6 +24,11 @@ jobs:
         uses: leynos/shared-actions/.github/actions/setup-rust@c6559452842af6a83b83429129dccaf910e34562
         with:
           toolchain: ${{ matrix.rust }}
+      - name: Show rustc version
+        run: |
+          rustup show
+          rustc --version
+          cargo --version
       - name: Cache Cargo
         uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4
         with:
@@ -30,8 +36,9 @@ jobs:
             ~/.cargo/registry
             ~/.cargo/git
             target
-          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
+          key: ${{ runner.os }}-cargo-${{ matrix.rust }}-${{ hashFiles('**/Cargo.lock') }}
           restore-keys: |
+            ${{ runner.os }}-cargo-${{ matrix.rust }}-
             ${{ runner.os }}-cargo-
       - name: Clean build artefacts
         run: make clean
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index dcd145cb..4512feb7 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -55,10 +55,10 @@ jobs:
 #            target: aarch64-unknown-openbsd
 #            ext: ""
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
       - name: Setup Python 3.11
         id: setup-python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: '3.11'
       - name: Verify tag matches Cargo.toml
@@ -87,8 +87,15 @@ PY
         uses: leynos/shared-actions/.github/actions/setup-rust@c6559452842af6a83b83429129dccaf910e34562
       - name: Install MSRV toolchain
         run: rustup toolchain install 1.89.0
+      - name: Add MSRV release target
+        run: rustup +1.89.0 target add ${{ matrix.target }}
+      - name: Show Rust versions
+        run: |
+          rustup show
+          rustc +1.89.0 --version
+          rustc +stable --version
       - name: Cache cross binary
-        uses: actions/cache@v4
+        uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4
         with:
           path: ~/.cargo/bin/cross
           key: cross-v0.2.5-${{ runner.os }}
@@ -96,8 +103,10 @@ PY
         env:
           RUSTFLAGS: ""
         run: cargo install cross --git https://github.com/cross-rs/cross --tag v0.2.5
+      - name: Verify MSRV build
+        run: cross +1.89.0 build --release --target ${{ matrix.target }}
       - name: Cache cargo registry
-        uses: actions/cache@v4
+        uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4
         with:
           path: |
             ~/.cargo/registry
@@ -107,9 +116,7 @@ PY
           restore-keys: |
             ${{ runner.os }}-cargo-
       - name: Add release target
-        run: rustup target add ${{ matrix.target }}
-      - name: Verify MSRV build
-        run: cross +1.89.0 build --release --target ${{ matrix.target }}
+        run: rustup +stable target add ${{ matrix.target }}
       - name: Build release binary
         run: cross +stable build --release --target ${{ matrix.target }}
       - name: Prepare artifact
@@ -120,7 +127,7 @@ PY
           sha256sum artifacts/${{ matrix.os }}-${{ matrix.arch }}/${{ env.REPO_NAME }}-${{ matrix.os }}-${{ matrix.arch }}${{ matrix.ext }} > \
             artifacts/${{ matrix.os }}-${{ matrix.arch }}/${{ env.REPO_NAME }}-${{ matrix.os }}-${{ matrix.arch }}${{ matrix.ext }}.sha256
       - name: Upload release artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: ${{ env.REPO_NAME }}-${{ matrix.os }}-${{ matrix.arch }}
           path: artifacts/${{ matrix.os }}-${{ matrix.arch }}
@@ -129,11 +136,11 @@ PY
     needs: build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: softprops/action-gh-release@v1
+      - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
+      - uses: softprops/action-gh-release@26994186c0ac3ef5cae75ac16aa32e8153525f77 # v1
         with:
           generate_release_notes: true
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
         with:
           path: artifacts
       - run: |

From 8f62d2a9ed67acf73472401c0494e061f2e7a5d5 Mon Sep 17 00:00:00 2001
From: Leynos <leynos@troubledskies.net>
Date: Sun, 24 Aug 2025 15:02:58 +0100
Subject: [PATCH 3/4] Refine workflows per review feedback

---
 .github/workflows/ci.yml               | 13 ++++++++-----
 .github/workflows/netsukefile-test.yml |  6 +++---
 .github/workflows/release.yml          | 20 ++++++++++++--------
 3 files changed, 23 insertions(+), 16 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index caf732c2..e1e16f0b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -19,12 +19,17 @@ jobs:
       CARGO_TERM_COLOR: always
       BUILD_PROFILE: debug
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633  # v4.1.2
       - name: Setup Rust
         uses: leynos/shared-actions/.github/actions/setup-rust@c6559452842af6a83b83429129dccaf910e34562
         with:
           toolchain: ${{ matrix.rust }}
           components: rustfmt, clippy
+      - name: Show rustc version
+        run: |
+          rustup show
+          rustc --version
+          cargo --version
       - name: Show Ninja version
         run: ninja --version
       - name: Format
@@ -40,11 +45,9 @@ jobs:
           output-path: lcov.info
           format: lcov
       - name: Upload coverage data to CodeScene
-        env:
-          CS_ACCESS_TOKEN: ${{ secrets.CS_ACCESS_TOKEN }}
-        if: matrix.rust == 'stable' && env.CS_ACCESS_TOKEN
+        if: matrix.rust == 'stable' && secrets.CS_ACCESS_TOKEN != ''
         uses: leynos/shared-actions/.github/actions/upload-codescene-coverage@c6559452842af6a83b83429129dccaf910e34562
         with:
           format: lcov
-          access-token: ${{ env.CS_ACCESS_TOKEN }}
+          access-token: ${{ secrets.CS_ACCESS_TOKEN }}
           installer-checksum: ${{ vars.CODESCENE_CLI_SHA256 }}
diff --git a/.github/workflows/netsukefile-test.yml b/.github/workflows/netsukefile-test.yml
index 66bf5073..344d0198 100644
--- a/.github/workflows/netsukefile-test.yml
+++ b/.github/workflows/netsukefile-test.yml
@@ -19,7 +19,7 @@ jobs:
       RUSTUP_TOOLCHAIN: ${{ matrix.rust }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
+        uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633  # v4.1.2
       - name: Setup Rust
         uses: leynos/shared-actions/.github/actions/setup-rust@c6559452842af6a83b83429129dccaf910e34562
         with:
@@ -30,12 +30,12 @@ jobs:
           rustc --version
           cargo --version
       - name: Cache Cargo
-        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4
+        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684  # v4
         with:
+          # Do not cache build outputs when running make clean
           path: |
             ~/.cargo/registry
             ~/.cargo/git
-            target
           key: ${{ runner.os }}-cargo-${{ matrix.rust }}-${{ hashFiles('**/Cargo.lock') }}
           restore-keys: |
             ${{ runner.os }}-cargo-${{ matrix.rust }}-
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 4512feb7..2a66aa40 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -10,6 +10,8 @@ env:
 
 jobs:
   build:
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     strategy:
       matrix:
@@ -55,10 +57,10 @@ jobs:
 #            target: aarch64-unknown-openbsd
 #            ext: ""
     steps:
-      - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
+      - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633  # v4.1.2
       - name: Setup Python 3.11
         id: setup-python
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
         with:
           python-version: '3.11'
       - name: Verify tag matches Cargo.toml
@@ -95,7 +97,7 @@ PY
           rustc +1.89.0 --version
           rustc +stable --version
       - name: Cache cross binary
-        uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4
+        uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809  # v4
         with:
           path: ~/.cargo/bin/cross
           key: cross-v0.2.5-${{ runner.os }}
@@ -106,7 +108,7 @@ PY
       - name: Verify MSRV build
         run: cross +1.89.0 build --release --target ${{ matrix.target }}
       - name: Cache cargo registry
-        uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4
+        uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809  # v4
         with:
           path: |
             ~/.cargo/registry
@@ -127,20 +129,22 @@ PY
           sha256sum artifacts/${{ matrix.os }}-${{ matrix.arch }}/${{ env.REPO_NAME }}-${{ matrix.os }}-${{ matrix.arch }}${{ matrix.ext }} > \
             artifacts/${{ matrix.os }}-${{ matrix.arch }}/${{ env.REPO_NAME }}-${{ matrix.os }}-${{ matrix.arch }}${{ matrix.ext }}.sha256
       - name: Upload release artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4
         with:
           name: ${{ env.REPO_NAME }}-${{ matrix.os }}-${{ matrix.arch }}
           path: artifacts/${{ matrix.os }}-${{ matrix.arch }}
 
   release:
     needs: build
+    permissions:
+      contents: write
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
-      - uses: softprops/action-gh-release@26994186c0ac3ef5cae75ac16aa32e8153525f77 # v1
+      - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633  # v4.1.2
+      - uses: softprops/action-gh-release@26994186c0ac3ef5cae75ac16aa32e8153525f77  # v1
         with:
           generate_release_notes: true
-      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093  # v4
         with:
           path: artifacts
       - run: |

From 449a3aa8c58f6bfc864785edbbbc41b25c17de71 Mon Sep 17 00:00:00 2001
From: Leynos <leynos@troubledskies.net>
Date: Sun, 24 Aug 2025 21:16:59 +0100
Subject: [PATCH 4/4] Lock cross install in release workflow

---
 .github/workflows/release.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2a66aa40..473f0f01 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -104,7 +104,7 @@ PY
       - name: Install cross
         env:
           RUSTFLAGS: ""
-        run: cargo install cross --git https://github.com/cross-rs/cross --tag v0.2.5
+        run: cargo install --locked cross --git https://github.com/cross-rs/cross --tag v0.2.5
       - name: Verify MSRV build
         run: cross +1.89.0 build --release --target ${{ matrix.target }}
       - name: Cache cargo registry