generate-lockfile overwrites a checked-in Cargo.lock

[andrewhalle]

Copying actions-rs#163 to this fork.

Description

This action calls cargo generate-lockfile, which overwrites Cargo.lock according to cargo docs¹

This command will create the Cargo.lock lockfile for the current package or workspace. If the lockfile already exists, it will be rebuilt with the latest available version of every package.

This negates the purpose of having a checked-in lockfile.

Proposed Fix

actions-rs#163 (comment)

Rather than call cargo generate-lockfile, call cargo metadata --format-version=1 >/dev/null instead.

Footnotes

1. https://doc.rust-lang.org/cargo/commands/cargo-generate-lockfile.html ↩

[tillmann-crabnebula]

FYI this is fixed in latest main but not released yet.

[tarcieri]

Fixed in v2.0.0