Please allow for not updating the lockfile (eg: with a --locked option).

[cstorey]

📋 Description

Context
I tend to to do CI builds by passing --locked to everything that triggers a build, to ensure that the lockfile is up to date. However, I'd also gotten into the habit of using cargo fmt --all -- --check before the build, so we can get faster feedback on small changes that need to happen.

The Problem

However, I'd found that builds that had passed cargo build --locked on CI still had a stale lockfile. After some poking (such as removing write permissions on the lockfile) it turns out that running cargo fmt will update the lockfile, as it uses cargo metadata (or at least it's core implementation) to figure out where the roots of each lockfile.

However, it appears that cargo metadata will default to updating the lockfile unless --locked or --frozen is passed. So running cargo fmt -- --check before cargo build --locked means the latter isn't checking what's in source control.

Proposed solution

I think that the most coherent option for now is to add --frozen and --locked options to cargo fmt, along with the rest of the suite.

[cstorey]

Oh, and I should also say thanks! This is a hugely useful tool, and greatly appreciate all of the hard work that's gone into this one part of the ecosystem.

[calebcartwright]

Thanks for reaching out, but think I'm probably going to close this as another symptom of the root cause covered in #4247. The core of this issue is that --all actually has to support a ton of use cases, and in order to do so it at the moment has to call cargo metadata without the --no-deps arg which is what results in the lockfile an registry hit.

This was driven by the nature of the cargo metadata output which has subsequently changed, and instead of iterating on that existing flow we really just need to make the update which allows us to always include --no-deps, and that in turn solves the problem reported in this issue as well as various others.

In the short term, if you are using an explicit workspace and have your workspace members defined (as opposed to just a tree of packages with relative path based dependencies on each other) then you don't even need to use the --all flag with cargo fmt. Running cargo fmt in the root of a workspace will already format everything in that workspace.

[cstorey]

Ah, that's great! Thanks for the easy solution.