Commit Cargo.lock

[lukepalmer]

Commit Cargo.lock so that we have a deterministic build.

Here is some discussion on why this a good thing to do:

• https://doc.rust-lang.org/cargo/faq.html#why-have-cargolock-in-version-control
• https://blog.rust-lang.org/2023/08/29/committing-lockfiles/

My other motivation is that I would like to make / contribute a nix package for valkey-bloom, and a committed Cargo.lock makes this much cleaner.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 03a753ea-593e-4bea-b2d8-6873d0fe8122

📥 Commits

Reviewing files that changed from the base of the PR and between 74d7eb1 and 5878902.

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (3)

• .github/workflows/ci.yml
• .gitignore
• build.sh

💤 Files with no reviewable changes (1)

• .gitignore

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The pull request stops ignoring Cargo.lock and adds --locked to Clippy, release-build, and unit-test Cargo commands in the build script and CI workflow.

Changes

Cargo lockfile enforcement

Layer / File(s)	Summary
Track the lockfile and enforce locked Cargo commands .gitignore, build.sh, .github/workflows/ci.yml	.gitignore no longer excludes Cargo.lock. The build script and CI jobs pass --locked to Clippy, release-build, and unit-test commands. Existing build arguments and Valkey 8.0 feature selection remain unchanged.

Priority: ⬇️ Low

Change: Other

Merge Risk: ⚪ Minimal · up to 58789

The lockfile enforcement change is mergeable after normal checks. No supported build failure or other blocking issue is identified.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 58789

The change makes builds use committed dependency versions and does not appear to expand application access or build-script authority. The complete locked dependency set has not been independently validated.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The new constraint applies to Cargo dependency resolution in the build script and three CI jobs, not to every external input used by those jobs.

Trust Boundaries and Controls

• inferred — Using --locked constrains dependency resolution to the checked-out lockfile; it does not independently establish the trustworthiness of changes to that file.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the main change: committing Cargo.lock for deterministic builds.
Description check	✅ Passed	The description explains that committing Cargo.lock supports deterministic builds and simplifies Nix packaging, which directly matches the changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}