Bug
If `contracts/Cargo.lock` is listed in `.gitignore` or not committed to the repository, dependency versions are resolved fresh on every `cargo build`. This means:
- CI builds today and tomorrow may use different minor/patch versions of crates
- A dependency update (even a patch version) can break the build with no code changes
- Security audit results are invalid because the exact dependency tree is unknown
- Reproducible builds are impossible
Check
```bash
git ls-files contracts/Cargo.lock
If this returns nothing, Cargo.lock is not tracked
```
Fix
For binary/application crates (contracts are treated as binaries by Soroban), `Cargo.lock` MUST be committed:
```bash
Remove from .gitignore if present
Then:
git add contracts/Cargo.lock
git commit -m "chore: commit Cargo.lock for reproducible builds"
```
Also add a CI step that verifies the lock file is up to date:
```yaml
- name: Verify Cargo.lock is up to date
run: cargo update --locked
```
Acceptance Criteria
References
- `contracts/`
- `.gitignore`
- `.github/workflows/ci.yml`
Bug
If `contracts/Cargo.lock` is listed in `.gitignore` or not committed to the repository, dependency versions are resolved fresh on every `cargo build`. This means:
Check
```bash
git ls-files contracts/Cargo.lock
If this returns nothing, Cargo.lock is not tracked
```
Fix
For binary/application crates (contracts are treated as binaries by Soroban), `Cargo.lock` MUST be committed:
```bash
Remove from .gitignore if present
Then:
git add contracts/Cargo.lock
git commit -m "chore: commit Cargo.lock for reproducible builds"
```
Also add a CI step that verifies the lock file is up to date:
```yaml
run: cargo update --locked
```
Acceptance Criteria
References