Shake your foundation: make, don't panic & derive..

.github/scripts/install-yq.sh

@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+#
+# Installs yq (mikefarah/yq) into ~/.local/bin with SHA256 verification.
+# Intended for CI runners (Linux amd64).
+
+set -euo pipefail
+
+YQ_VERSION="${YQ_VERSION:-v4.52.4}"
+INSTALL_DIR="$HOME/.local/bin"
+BASE_URL="https://github.com/mikefarah/yq/releases/download/${YQ_VERSION}"
+
+mkdir -p "$INSTALL_DIR"
+
+wget -qO "$INSTALL_DIR/yq_linux_amd64" "${BASE_URL}/yq_linux_amd64"
+wget -qO "$INSTALL_DIR/checksums-bsd"   "${BASE_URL}/checksums-bsd"
+
+(
+    cd "$INSTALL_DIR"
+    # checksums-bsd uses BSD-style:   SHA256 (yq_linux_amd64) = 0c4d965e...
+    # sha256sum -c expects GNU-style: 0c4d965e...  yq_linux_amd64
+    # sed captures the filename (\1) and hash (\2), discarding "SHA256 (", ") = ",
+    # then emits them in reversed order to match GNU format.
+    grep 'SHA256 (yq_linux_amd64)' checksums-bsd \
+        | sed 's/SHA256 (\(.*\)) = \(.*\)/\2  \1/' \
+        | sha256sum -c -
+    mv yq_linux_amd64 yq
+    rm -f checksums-bsd
+    chmod +x yq
+)
+
+echo "$INSTALL_DIR" >> "${GITHUB_PATH:-/dev/null}"

.github/workflows/test.yml

@@ -22,10 +22,24 @@ jobs:
           ref: ${{ github.event.pull_request.head.sha }}
           submodules: recursive
 
+      - name: Install yq
+        run: .github/scripts/install-yq.sh
+
+      - name: 'Read nightly channel from rust-toolchain.toml'
+        id: toolchain-meta
+        run: |
+          set -euo pipefail
+          CHANNEL=$(yq -r '.toolchain.channel' rust-toolchain.toml)
+          if [ -z "$CHANNEL" ] || [ "$CHANNEL" = "null" ]; then
+            echo "::error::Could not read toolchain.channel from rust-toolchain.toml"
+            exit 1
+          fi
+          echo "channel=$CHANNEL" >> "$GITHUB_OUTPUT"
+
       - name: "Set up nightly Rust" # https://github.com/rust-lang/rustup/issues/3409
         uses: dtolnay/rust-toolchain@master
         with:
-          toolchain: nightly-2024-11-29 # Hardcoded version, same as is in the build.rs
+          toolchain: ${{ steps.toolchain-meta.outputs.channel }}
 
       - name: 'Build stable-mir-json' # rustfmt documentation claims it is unstable on code that doesn't build
         run: |
@@ -66,10 +80,24 @@ jobs:
           ref: ${{ github.event.pull_request.head.sha }}
           submodules: recursive
 
+      - name: Install yq
+        run: .github/scripts/install-yq.sh
+
+      - name: 'Read nightly channel from rust-toolchain.toml'
+        id: toolchain-meta
+        run: |
+          set -euo pipefail
+          CHANNEL=$(yq -r '.toolchain.channel' rust-toolchain.toml)
+          if [ -z "$CHANNEL" ] || [ "$CHANNEL" = "null" ]; then
+            echo "::error::Could not read toolchain.channel from rust-toolchain.toml"
+            exit 1
+          fi
+          echo "channel=$CHANNEL" >> "$GITHUB_OUTPUT"
+
       - name: "Set up nightly Rust" # https://github.com/rust-lang/rustup/issues/3409
         uses: dtolnay/rust-toolchain@master
         with:
-          toolchain: nightly-2024-11-29 # Hardcoded version, same as is in the build.rs
+          toolchain: ${{ steps.toolchain-meta.outputs.channel }}
 
       - name: 'Build stable-mir-json'
         run: | # Warning check should be redundant since code-quality runs first
@@ -100,24 +128,31 @@ jobs:
           submodules: recursive
 
       - name: Install yq
+        run: .github/scripts/install-yq.sh
+
+      - name: 'Read nightly channel from rust-toolchain.toml'
+        id: toolchain-meta
         run: |
           set -euo pipefail
-          YQ_VERSION="v4.52.4"
-          mkdir -p "$HOME/.local/bin"
-          wget -qO "$HOME/.local/bin/yq" \
-            "https://github.com/mikefarah/yq/releases/download/${YQ_VERSION}/yq_linux_amd64"
-          chmod +x "$HOME/.local/bin/yq"
-          echo "$HOME/.local/bin" >> $GITHUB_PATH
-          yq --version
+          CHANNEL=$(yq -r '.toolchain.channel' rust-toolchain.toml)
+          if [ -z "$CHANNEL" ] || [ "$CHANNEL" = "null" ]; then
+            echo "::error::Could not read toolchain.channel from rust-toolchain.toml"
+            exit 1
+          fi
+          echo "channel=$CHANNEL" >> "$GITHUB_OUTPUT"
 
+      - name: "Set up nightly Rust" # https://github.com/rust-lang/rustup/issues/3409
+        uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: ${{ steps.toolchain-meta.outputs.channel }}
 
-      - name: 'Read rustc commit from rust-toolchain.toml'
+      - name: 'Derive rustc commit and check out Rust repo'
         id: rustc-meta
         run: |
           set -euo pipefail
-          COMMIT=$(yq '.metadata.rustc-commit' rust-toolchain.toml)
-          if [ -z "$COMMIT" ] || [ "$COMMIT" = "null" ]; then
-            echo "::error::metadata.rustc-commit not found in rust-toolchain.toml"
+          COMMIT=$(rustc -vV | grep 'commit-hash' | cut -d' ' -f2)
+          if [ -z "$COMMIT" ]; then
+            echo "::error::Could not determine rustc commit-hash from 'rustc -vV'"
             exit 1
           fi
           echo "rustc-commit=$COMMIT" >> "$GITHUB_OUTPUT"
@@ -130,11 +165,6 @@ jobs:
           path: rust
           fetch-depth: 1
 
-      - name: "Set up nightly Rust" # https://github.com/rust-lang/rustup/issues/3409
-        uses: dtolnay/rust-toolchain@master
-        with:
-          toolchain: nightly-2024-11-29 # Hardcoded version, same as is in the build.rs
-
       - name: 'Build stable-mir-json'
         run: | # Warning check should be redundant since code-quality runs first
           RUSTFLAGS='--deny warnings' cargo build -vv