Pin rust version with toolchain file

.github/workflows/android-audit.yml

@@ -37,8 +37,7 @@ jobs:
 
       - name: Use default container image and resolve digest
         if: ${{ github.event.inputs.override_container_image == '' }}
-        run: |
-          echo "inner_container_image=$(cat ./building/android-container-image.txt)" >> $GITHUB_ENV
+        run: echo "inner_container_image=$(cat ./building/android-container-image.txt)" >> $GITHUB_ENV
 
     outputs:
       container_image: ${{ env.inner_container_image }}

.github/workflows/android-kotlin-format-check.yml

@@ -27,8 +27,7 @@ jobs:
 
       - name: Use default container image and resolve digest
         if: ${{ github.event.inputs.override_container_image == '' }}
-        run: |
-          echo "inner_container_image=$(cat ./building/android-container-image.txt)" >> $GITHUB_ENV
+        run: echo "inner_container_image=$(cat ./building/android-container-image.txt)" >> $GITHUB_ENV
 
     outputs:
       container_image: ${{ env.inner_container_image }}

.github/workflows/cargo-vendor.yml

@@ -23,11 +23,5 @@ jobs:
         with:
           submodules: true
 
-      - name: Install Rust
-        uses: actions-rs/toolchain@v1.0.6
-        with:
-          toolchain: stable
-          default: true
-
       - name: Vendor Rust dependencies
         run: cargo vendor

.github/workflows/clippy.yml

@@ -25,8 +25,7 @@ jobs:
 
       - name: Use default container image and resolve digest
         if: ${{ github.event.inputs.override_container_image == '' }}
-        run: |
-          echo "inner_container_image_android=$(cat ./building/android-container-image.txt)" >> $GITHUB_ENV
+        run: echo "inner_container_image_android=$(cat ./building/android-container-image.txt)" >> $GITHUB_ENV
 
     outputs:
       container_image_android: ${{ env.inner_container_image_android }}
@@ -51,12 +50,6 @@ jobs:
           git submodule update --init --depth=1 dist-assets/binaries
           git submodule update --init --recursive --depth=1 wireguard-go-rs
 
-      - uses: actions-rs/toolchain@v1.0.6
-        with:
-          toolchain: stable
-          components: clippy
-          override: true
-
       - name: Install build dependencies
         if: matrix.os == 'ubuntu-latest'
         run: |

.github/workflows/daemon.yml

@@ -49,8 +49,7 @@ jobs:
 
       - name: Use default container image and resolve digest
         if: ${{ github.event.inputs.override_container_image == '' }}
-        run: |
-          echo "inner_container_image=$(cat ./building/linux-container-image.txt)" >> $GITHUB_ENV
+        run: echo "inner_container_image=$(cat ./building/linux-container-image.txt)" >> $GITHUB_ENV
 
     outputs:
       container_image: ${{ env.inner_container_image }}
@@ -79,9 +78,15 @@ jobs:
           git config --global --add safe.directory '*'
           git submodule update --init --depth=1 dist-assets/binaries
           git submodule update --init --recursive --depth=1 wireguard-go-rs
-      # The container image already has rustup and Rust, but only the stable toolchain
+
+      # The container image already has rustup and the pinned version of Rust
       - name: Install Rust toolchain
-        run: rustup default ${{ matrix.rust }}
+        # When running this job for "stable" test against our pinned rust version
+        # instead of the stable channel.
+        # TODO: Improve this so both "stable" and the pinned version are tested if
+        # they differ.
+        if: ${{ matrix.rust != 'stable' }}
+        run: rustup override set ${{ matrix.rust }}
 
       - name: Build and test crates
         run: ./ci/check-rust.sh
@@ -102,12 +107,6 @@ jobs:
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Install Rust
-        uses: actions-rs/toolchain@v1.0.6
-        with:
-          toolchain: stable
-          default: true
-
       - name: Install Go
         uses: actions/setup-go@v3
         with:
@@ -168,17 +167,10 @@ jobs:
       # TODO: Remove once fixed
       - name: Install Rust x64 target
         if: ${{ matrix.config.arch == 'arm64' }}
-        uses: actions-rs/toolchain@v1.0.6
-        with:
-          toolchain: stable
-          target: x86_64-pc-windows-msvc
+        run: rustup target add x86_64-pc-windows-msvc
 
       - name: Install Rust
-        uses: actions-rs/toolchain@v1.0.6
-        with:
-          toolchain: stable
-          target: i686-pc-windows-msvc
-          default: true
+        run: rustup target add i686-pc-windows-msvc
 
       - name: Install msbuild
         uses: microsoft/setup-msbuild@v1.0.2

.github/workflows/desktop-e2e.yml

@@ -195,11 +195,7 @@ jobs:
           cache: 'npm'
           cache-dependency-path: desktop/package-lock.json
       - name: Install Rust
-        uses: actions-rs/toolchain@v1.0.6
-        with:
-          toolchain: stable
-          target: i686-pc-windows-msvc
-          default: true
+        run: rustup target add i686-pc-windows-msvc
       - name: Install latest zig
         uses: mlugg/setup-zig@v1
       - name: Install msbuild
@@ -287,11 +283,6 @@ jobs:
           node-version-file: desktop/package.json
           cache: 'npm'
           cache-dependency-path: desktop/package-lock.json
-      - name: Install Rust
-        uses: actions-rs/toolchain@v1.0.6
-        with:
-          toolchain: stable
-          default: true
       - name: Build app
         run: ./build.sh
       - name: Build test executable

.github/workflows/frontend.yml

@@ -24,13 +24,6 @@ jobs:
       - name: Checkout wireguard-go submodule
         run: git submodule update --init --depth=1 wireguard-go-rs
 
-      - name: Install Rust
-        uses: actions-rs/toolchain@v1.0.6
-        with:
-          toolchain: stable
-          default: true
-          profile: minimal
-
       - name: Setup node
         uses: actions/setup-node@v4
         with:

.github/workflows/ios-build-xcode-16.yml

@@ -46,10 +46,7 @@ jobs:
         with:
           xcode-version: '16.1'
       - name: Configure Rust
-        run: |
-          rustup default stable
-          rustup update stable
-          rustup target add aarch64-apple-ios-sim
+        run: rustup target add aarch64-apple-ios-sim
 
       - name: Configure Xcode project
         run: |

.github/workflows/ios-end-to-end-tests.yml

@@ -99,11 +99,7 @@ jobs:
           ref: ${{ env.COMMIT_HASH }}
 
       - name: Configure Rust
-        uses: actions-rs/toolchain@v1.0.6
-        with:
-          toolchain: stable
-          override: true
-          target: aarch64-apple-ios
+        run: rustup target add aarch64-apple-ios
 
       - name: Build iOS end to end tests action
         uses: ./.github/actions/build-ios-e2e-tests

.github/workflows/ios-rust-ffi.yml

@@ -26,11 +26,7 @@ jobs:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Install Rust
-        uses: actions-rs/toolchain@v1.0.6
-        with:
-          toolchain: stable
-          target: ${{ matrix.target }}
-          default: true
+        run: rustup target add ${{ matrix.target }}
 
       - name: Build and test crates
         shell: bash
@@ -58,11 +54,7 @@ jobs:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Install Rust
-        uses: actions-rs/toolchain@v1.0.6
-        with:
-          toolchain: stable
-          target: ${{ matrix.target }}
-          default: true
+        run: rustup target add ${{ matrix.target }}
 
       - name: Clippy check
         shell: bash

.github/workflows/ios-screenshots-creation.yml

@@ -33,10 +33,7 @@ jobs:
         with:
           xcode-version: '16.1'
       - name: Configure Rust
-        run: |
-          rustup default stable
-          rustup update stable
-          rustup target add aarch64-apple-ios-sim x86_64-apple-ios
+        run: rustup target add aarch64-apple-ios-sim x86_64-apple-ios
 
       - name: Configure Xcode project
         run: |

.github/workflows/ios-screenshots-tests.yml

@@ -45,10 +45,7 @@ jobs:
         with:
           xcode-version: '16.1'
       - name: Configure Rust
-        run: |
-          rustup default stable
-          rustup update stable
-          rustup target add aarch64-apple-ios-sim
+        run: rustup target add aarch64-apple-ios-sim
 
       - name: Configure Xcode project
         run: |

.github/workflows/ios-validate-build-schemas.yml

@@ -46,10 +46,7 @@ jobs:
         with:
           xcode-version: '16.1'
       - name: Configure Rust
-        run: |
-          rustup default stable
-          rustup update stable
-          rustup target add aarch64-apple-ios-sim x86_64-apple-ios
+        run: rustup target add aarch64-apple-ios-sim x86_64-apple-ios
 
       - name: Configure Xcode project
         run: |

.github/workflows/ios.yml

@@ -91,8 +91,6 @@ jobs:
         run: |
           brew bundle dump
           brew bundle
-          rustup default stable
-          rustup update stable
           rustup target add aarch64-apple-ios-sim
 
       - name: Configure Xcode project

.github/workflows/rust-unused-dependencies.yml

@@ -51,7 +51,7 @@ jobs:
           git submodule update --init --recursive --depth=1 wireguard-go-rs
 
       - name: Install nightly Rust toolchain
-        run: rustup default $RUST_NIGHTLY_TOOLCHAIN
+        run: rustup override set $RUST_NIGHTLY_TOOLCHAIN
 
       - uses: taiki-e/install-action@v2
         with:
@@ -81,9 +81,9 @@ jobs:
           git config --global --add safe.directory '*'
           git submodule update --init --recursive --depth=1 wireguard-go-rs
 
-      - name: Install nightly Rust toolchain
+      - name: Install nightly Rust
         run: |
-          rustup default $RUST_NIGHTLY_TOOLCHAIN
+          rustup override set ${{ env.RUST_NIGHTLY_TOOLCHAIN }}
           rustup target add aarch64-linux-android
 
       - uses: taiki-e/install-action@v2
@@ -123,12 +123,8 @@ jobs:
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Install Rust
-        uses: actions-rs/toolchain@v1.0.6
-        with:
-          toolchain: ${{ env.RUST_NIGHTLY_TOOLCHAIN }}
-          default: true
-          profile: minimal
+      - name: Install nightly Rust
+        run: rustup override set ${{ env.RUST_NIGHTLY_TOOLCHAIN }}
 
       - uses: taiki-e/install-action@v2
         with:

.github/workflows/rustfmt.yml

@@ -20,13 +20,6 @@ jobs:
       - name: Checkout wireguard-go submodule
         run: git submodule update --init --depth=1 wireguard-go-rs
 
-      - name: Install nightly Rust
-        uses: actions-rs/toolchain@v1.0.6
-        with:
-          toolchain: stable
-          components: rustfmt
-          default: true
-
       - name: Check formatting
         run: |-
           rustfmt --version

.github/workflows/testframework-clippy.yml

@@ -28,12 +28,6 @@ jobs:
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
 
-      - uses: actions-rs/toolchain@v1.0.6
-        with:
-          toolchain: stable
-          components: clippy
-          override: true
-
       - name: Install build dependencies
         if: matrix.os == 'ubuntu-latest'
         run: |
@@ -61,12 +55,6 @@ jobs:
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
 
-      - uses: actions-rs/toolchain@v1.0.6
-        with:
-          toolchain: stable
-          components: clippy
-          override: true
-
       - name: Clippy check
         working-directory: test
         shell: bash

.github/workflows/testframework-rustfmt.yml

@@ -18,13 +18,6 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
 
-      - name: Install Rust
-        uses: actions-rs/toolchain@v1.0.6
-        with:
-          toolchain: stable
-          components: rustfmt
-          default: true
-
       - name: Check formatting
         working-directory: test
         run: |-

.github/workflows/testframework.yml

@@ -42,8 +42,7 @@ jobs:
 
       - name: Use default container image and resolve digest
         if: ${{ github.event.inputs.override_container_image == '' }}
-        run: |
-          echo "inner_container_image=$(cat ./building/linux-container-image.txt)" >> $GITHUB_ENV
+        run: echo "inner_container_image=$(cat ./building/linux-container-image.txt)" >> $GITHUB_ENV
 
     outputs:
       container_image: ${{ env.inner_container_image }}
@@ -83,12 +82,6 @@ jobs:
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Install Rust
-        uses: actions-rs/toolchain@v1.0.6
-        with:
-          toolchain: stable
-          default: true
-
       - name: Build test runner
         working-directory: test
         run: cargo build --locked

.github/workflows/translations-converter.yml

@@ -16,12 +16,6 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
 
-      - name: Install Rust
-        uses: actions-rs/toolchain@v1.0.6
-        with:
-          toolchain: stable
-          default: true
-
       - name: Build and test translations converter tool
         working-directory: android/translations-converter
         run: cargo test

.github/workflows/translations.yml

@@ -32,12 +32,6 @@ jobs:
         shell: bash
         run: npm ci
 
-      - name: Install Rust
-        uses: actions-rs/toolchain@v1.0.6
-        with:
-          toolchain: stable
-          default: true
-
       - name: Verify translations
         shell: bash
         run: scripts/localization verify

.github/workflows/verify-locked-down-signatures.yml

@@ -11,6 +11,7 @@ on:
       - test/Cargo.lock
       - deny.toml
       - test/deny.toml
+      - rust-toolchain.toml
       - desktop/package-lock.json
       - wireguard-go-rs/libwg/go.sum
       - ci/keys/**