main was already merged to feat/multichain, so this should be safe to do, i.e. the action should already be there.

Why not use inputs to the setup-rust action?

https://github.com/NomicFoundation/edr/blob/feat/multichain/.github/actions/setup-node/action.yml#L4

I found it to be a lot simpler - we just execute setup-rust as our baseline "setup Rust toolchain as expected" and this is the only exception to this. Since it's a one-liner and used only here, I found it simpler to just call this directly and keep the main action lean.

EDIT: To expand a bit on the rationale, I did try that initially, but we'd have to be more explicit, i.e. support and pass override: false for clarity, support and handle components, support it being optional and pass some if missing (I do install always install clippy for simplicity as the cost is near-zero; unfortunately the overhead of cross-platform setup via bash is bigger when using this action vs actions-rs).

The nightly rustfmt is also hopefully only a temporary solution until upstream stabilises the two options that we use, so I did not want to come up with a principled approach to a one-off that's hopefully temporary anyway 🤞

You can have default values for all inputs of an action, which would keep the default action lean too, while allowing configuration.

I'll leave it up to you to decide whether to take that approach or not.

I tried to find a middle ground in e7796f7, hope that's okay with you.

Thanks! That's exactly what I had in mind :)

I would suggest pinning the version of this action to a commit ref unless it comes from an organization we own or trust. Otherwise, we could open up an attack vector.

      uses: actions-rust-lang/setup-rust-toolchain@4d1965c9142484e48d40c19de54b5cba84953a06 # v1.1.0

Ref: https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions