CI: Run test with recent/minimal lock files

Update the CI scripts to use the minimal/recent lockfiles, requires
using `--lock` for various `cargo` incantations.

Author: tcharding

.github/workflows/rust.yml

@@ -115,4 +115,5 @@ jobs:
       - name: Running WASM tests
         env:
           DO_WASM: true
-        run: ./contrib/test.sh
+        # We do not control the cargo commands so cannot us --locked to lock the manifest.
+        run: ./contrib/_test.sh

contrib/_test.sh

@@ -20,56 +20,56 @@ if cargo --version | grep "1\.48"; then
 fi
 
 # Test if panic in C code aborts the process (either with a real panic or with SIGILL)
-cargo test -- --ignored --exact 'tests::test_panic_raw_ctx_should_terminate_abnormally' 2>&1 | tee /dev/stderr | grep "SIGILL\\|panicked at '\[libsecp256k1\]"
+cargo test --locked -- --ignored --exact 'tests::test_panic_raw_ctx_should_terminate_abnormally' 2>&1 | tee /dev/stderr | grep "SIGILL\\|panicked at '\[libsecp256k1\]"
 
 # Make all cargo invocations verbose
 export CARGO_TERM_VERBOSE=true
 
 # Defaults / sanity checks
-cargo build --all
-cargo test --all
+cargo build --locked --all
+cargo test --locked --all
 
 if [ "$DO_FEATURE_MATRIX" = true ]; then
-    cargo build --all --no-default-features
-    cargo test --all --no-default-features
+    cargo build --locked --all --no-default-features
+    cargo test --locked --all --no-default-features
 
     # All features
-    cargo build --all --no-default-features --features="$FEATURES"
-    cargo test --all --no-default-features --features="$FEATURES"
+    cargo build --locked --all --no-default-features --features="$FEATURES"
+    cargo test --locked --all --no-default-features --features="$FEATURES"
     # Single features
     for feature in ${FEATURES}
     do
-        cargo build --all --no-default-features --features="$feature"
-        cargo test --all --no-default-features --features="$feature"
+        cargo build --locked --all --no-default-features --features="$feature"
+        cargo test --locked --all --no-default-features --features="$feature"
     done
     # Features tested with 'std' feature enabled.
     for feature in ${FEATURES}
     do
-        cargo build --all --no-default-features --features="std,$feature"
-        cargo test --all --no-default-features --features="std,$feature"
+        cargo build --locked --all --no-default-features --features="std,$feature"
+        cargo test --locked --all --no-default-features --features="std,$feature"
     done
     # Other combos
-    RUSTFLAGS='--cfg=secp256k1_fuzz' RUSTDOCFLAGS='--cfg=secp256k1_fuzz' cargo test --all
-    RUSTFLAGS='--cfg=secp256k1_fuzz' RUSTDOCFLAGS='--cfg=secp256k1_fuzz' cargo test --all --features="$FEATURES"
-    cargo test --all --features="rand serde"
+    RUSTFLAGS='--cfg=secp256k1_fuzz' RUSTDOCFLAGS='--cfg=secp256k1_fuzz' cargo test --locked --all
+    RUSTFLAGS='--cfg=secp256k1_fuzz' RUSTDOCFLAGS='--cfg=secp256k1_fuzz' cargo test --locked --all --features="$FEATURES"
+    cargo test --locked --all --features="rand serde"
 
     if [ "$NIGHTLY" = true ]; then
-        cargo test --all --all-features
-        RUSTFLAGS='--cfg=secp256k1_fuzz' RUSTDOCFLAGS='--cfg=secp256k1_fuzz' cargo test --all --all-features
+        cargo test --locked --all --all-features
+        RUSTFLAGS='--cfg=secp256k1_fuzz' RUSTDOCFLAGS='--cfg=secp256k1_fuzz' cargo test --locked --all --all-features
     fi
 
     # Examples
-    cargo run --example sign_verify --features=bitcoin-hashes-std
-    cargo run --example sign_verify_recovery --features=recovery,bitcoin-hashes-std
-    cargo run --example generate_keys --features=rand-std
+    cargo run --locked --example sign_verify --features=bitcoin-hashes-std
+    cargo run --locked --example sign_verify_recovery --features=recovery,bitcoin-hashes-std
+    cargo run --locked --example generate_keys --features=rand-std
 fi
 
 if [ "$DO_LINT" = true ]
 then
-    cargo clippy --all-features --all-targets -- -D warnings
-    cargo clippy --example sign_verify --features=bitcoin-hashes-std -- -D warnings
-    cargo clippy --example sign_verify_recovery --features=recovery,bitcoin-hashes-std -- -D warnings
-    cargo clippy --example generate_keys --features=rand-std -- -D warnings
+    cargo clippy --locked --all-features --all-targets -- -D warnings
+    cargo clippy --locked --example sign_verify --features=bitcoin-hashes-std -- -D warnings
+    cargo clippy --locked --example sign_verify_recovery --features=recovery,bitcoin-hashes-std -- -D warnings
+    cargo clippy --locked --example generate_keys --features=rand-std -- -D warnings
 fi
 
 # Build the docs if told to (this only works with the nightly toolchain)
@@ -87,9 +87,15 @@ fi
 if [ "$DO_WASM" = true ]; then
     clang --version
     CARGO_TARGET_DIR=wasm cargo install --force wasm-pack
+
+    cp Cargo.toml orig-Cargo.toml
     printf '\n[lib]\ncrate-type = ["cdylib", "rlib"]\n' >> Cargo.toml
+
     CC=clang wasm-pack build
     CC=clang wasm-pack test --node
+
+    rm Cargo.toml
+    mv orig-Cargo.toml Cargo.toml
 fi
 
 # Address Sanitizer

contrib/test.sh

@@ -4,4 +4,24 @@ set -ex
 
 REPO_DIR=$(git rev-parse --show-toplevel)
 
-$REPO_DIR/contrib/_test.sh
+DEPS="recent minimal"
+
+for dep in $DEPS
+do
+	cp "Cargo-$dep.lock" Cargo.lock
+    $REPO_DIR/contrib/_test.sh
+
+	if [ "$dep" = recent ];
+	then
+		# We always test committed dependencies but we want to warn if they could've been updated
+		cargo update
+		if diff Cargo-recent.lock Cargo.lock;
+		then
+			echo Dependencies are up to date
+		else
+			echo "::warning file=Cargo-recent.lock::Dependencies could be updated"
+		fi
+	fi
+done
+
+exit 0