PM-13335 - Pin Rust version and introduce Renovate

[tangowithfoxtrot]

🎟️ Tracking

https://bitwarden.atlassian.net/browse/PM-13335

📔 Objective

Add Renovate managers so we can pin the Rust and Rust nightly toolchains in our workflows.

📸 Screenshots

⏰ Reminders before review

• Contributor guidelines followed
• All formatters and local linters executed and passed
• Written new unit and / or integration tests where applicable
• Protected functional changes with optionality (feature flags)
• Used internationalization (i18n) for all UI strings
• CI builds passed
• Communicated to DevOps any deployment requirements
• Updated any necessary documentation (Confluence, contributing docs) or informed the documentation team

🦮 Reviewer guidelines

• 👍 (:+1:) or similar for great changes
• 📝 (:memo:) or ℹ️ (:information_source:) for notes or general info
• ❓ (:question:) for questions
• 🤔 (:thinking:) or 💭 (:thought_balloon:) for more open inquiry that's not quite a confirmed issue and could potentially benefit from discussion
• 🎨 (:art:) for suggestions / improvements
• ❌ (:x:) or ⚠️ (:warning:) for more significant problems or concerns needing attention
• 🌱 (:seedling:) or ♻️ (:recycle:) for future improvements or indications of technical debt
• ⛏ (:pick:) for minor or nitpick changes

[tangowithfoxtrot]

This is using a community-made Cloudflare worker. The source for it is here.

It would probably be ideal if we hosted our own for the sake of reliability. Thoughts?

[withinfocus]

Can we avoid the nightly support? Do we really need that? Seems unadvisable, and then we avoid custom datasources.

In parallel, if custom datasources are truly needed, I would think that's an investment to be proposed with Mend themselves and for it to become a first-class datasource that I have seen added via community contributions in the past (and not some Cloudflare worker that I don't support us using or implementing).

[tangowithfoxtrot]

@withinfocus I'd also prefer to avoid nightly toolchains, but the linting/formatting features we use, a tool we use to detect unused dependencies, and some rustdoc features all require usage of features that are not allowed on stable Rust toolchains.

There is an open PR for Renovate to support managing stable Rust toolchains via the rust-toolchain.toml file, but that still wouldn't handle our need for managing the nightly toolchains.

[withinfocus]

I pinged the Renovate PR author to see if we can help there.

Given my lack of Rust experience, can you show me what a Renovate PR would look like here? I see uses of certain versions in Cargo files but also stable, and for the nightly usages it's just nightly ... I don't know what this will create really.

[tangowithfoxtrot]

@withinfocus Sure! Here's a rust-nightly PR and a rust PR.

We're currently just invoking nightly as +nightly, but in order to use a pinned version, you would do this: +nightly-YYYY-MM-DD. The Renovate PRs would just update the date string for us.

Both the stable and nightly releases would be handled from a new rust-toolchain.toml file in the repo root. I probably should have mentioned that in my previous comment 😅

The rust-version defined in our Cargo file refers to the MSRV. I don't know of any hard-and-fast guidelines for how often that needs to be updated, but it seems like a value we probably wouldn't want Renovate to manage for us.

[withinfocus]

Yeah the toolchain configuration file existence was the missing part for me; I see it on your fork.

I'm a bit hesitant to approve here, but I do see this as a workable solution for now. While the dude's CF worker might not be the most reliable, it's something Renovate is invoking and it's not really exposing us to anything, and given the frequency and how Renovate works in general with clear logs about how it's running, this will do.

I look forward to enhanced Renovate support directly though.