ci: build, lint and test with --locked

.github/workflows/rust.yml

@@ -26,8 +26,14 @@ jobs:
       - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
       # `--workspace` is required: this is a root-package workspace (root `Cargo.toml` has both
       # `[package]` and `[workspace]`), so a bare `cargo build` selects only the root crate and would
-      # never compile the `shred-proxy` member. Same for clippy/test below.
-      - run: cargo build --workspace --release --verbose
+      # never compile the `shred-proxy` member.
+      # `--locked` mirrors the Dockerfile's `cargo build --release --locked`, which until now was
+      # the only place the lock was enforced: CI re-resolved silently, so a `Cargo.lock` Cargo would
+      # have to rewrite passed here and first surfaced days later as a failed GHCR publish — see
+      # issue #155, where two independently-resolved Dependabot locks merged into exactly that state
+      # and stalled the image publishes for three days.
+      # Both flags apply to clippy/test below too.
+      - run: cargo build --workspace --release --locked --verbose
 
   rust-lint:
     runs-on: ubuntu-latest
@@ -49,7 +55,7 @@ jobs:
       # The nightly toolchain above is now the default, but clippy is only installed on
       # stable — pin clippy to stable so it doesn't resolve to the (clippy-less) nightly.
       - name: clippy
-        run: cargo +stable clippy --workspace --all-targets -- -Dclippy::all -Dwarnings
+        run: cargo +stable clippy --workspace --all-targets --locked -- -Dclippy::all -Dwarnings
 
   rust-test:
     runs-on: ubuntu-latest
@@ -59,4 +65,4 @@ jobs:
         with:
           toolchain: stable
       - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
-      - run: cargo test --workspace --all-features --verbose
+      - run: cargo test --workspace --all-features --locked --verbose

CHANGELOG.md

@@ -14,6 +14,17 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   release does — is a v2 change, and upstream's own `sources/spec.md` still describes the field the
   old way. PROTOCOL.md records the same note beside the deprecation.
 
+### Security
+- **`cargo deny check advisories` failed on `main`: the dependency tree carried a yanked
+  `chacha20 0.10.1`.** It arrives through `tokio-tungstenite 0.30 -> tungstenite -> rand 0.10.2`,
+  which depends on it directly, so nothing in this crate chose the version and no `Cargo.toml`
+  change can avoid it — the lockfile is pinned forward to the republished `0.10.2` instead
+  (`cargo update -p chacha20`, lockfile only; the same update drops the `digest`/`generic-array`
+  chain `0.10.1` pulled in). A yanked crate is not itself a disclosed vulnerability, but the audit
+  denies it because a version its own author withdrew has no upgrade path and no advisory coverage,
+  and this one sits under the WebSocket stack's RNG. The check is a required status, so it also
+  blocked every unrelated pull request until now.
+
 ### Fixed
 - **A mirror publisher's `publisher_offset` was applied only by the market-by-price processor**, so
   top-of-book, midpoint and market-by-order stamped the raw wire `channel_id` into consumer-facing
@@ -126,6 +137,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   name and its 1,048,576-entry ceiling but is now sized by the retention window and the venue's
   removal rate rather than by how far the publishers lag.
 
+- **`rust` CI now builds, lints and tests with `--locked`.** The Dockerfile's
+  `cargo build --release --locked` was the only place the lock was enforced, so a `Cargo.lock` Cargo
+  would have to rewrite passed every check and first surfaced days later as a failed GHCR publish.
+  That is how two independently-resolved Dependabot lockfiles merged cleanly into an unusable one
+  and stalled the image publishes for three days, leaving `:mainnet-beta` on the 0.38.0 client base
+  across a doublezero release (#155). A stale or internally inconsistent lock now fails the PR that
+  introduces it.
+
 ### Added
 - ⚠️ **Kalshi elections, a pair of rows the registry did not have.** The political event markets are
   activated on the ledger and running on their own two groups, separate from perps and sports: