chore: stop sharing a cache with the binary the audit job runs

.gitlab-ci.yml

@@ -5,30 +5,38 @@ default:
       files:
         - Cargo.lock
     paths:
+      # no .cargo/bin here: the audit job runs what is in it, and this cache is
+      # shared by every branch and merge request, so a pipeline could otherwise
+      # leave behind the binary a later scheduled audit executes
       - .cargo/registry
-      # so the audit job does not rebuild cargo-audit on every schedule
-      - .cargo/bin
       - target
 
 variables:
   # keep the registry inside the project so it lands in the cache
   CARGO_HOME: $CI_PROJECT_DIR/.cargo
   CARGO_TERM_COLOR: always
+  # pinned, rather than whatever version exists on the night this runs
+  CARGO_AUDIT_VERSION: "0.21.2"
 
 # without this a push to a branch with an open merge request runs twice
 workflow:
   rules:
+    # first, because a scheduled pipeline sets CI_COMMIT_BRANCH as well and so
+    # would be matched by the branch rule below, or vetoed by the one above it
+    - if: $CI_PIPELINE_SOURCE == "schedule"
     - if: $CI_PIPELINE_SOURCE == "merge_request_event"
     - if: $CI_COMMIT_BRANCH && $CI_OPEN_MERGE_REQUESTS
       when: never
     - if: $CI_COMMIT_BRANCH
-    - if: $CI_PIPELINE_SOURCE == "schedule"
 
 check:
   script:
     - rustup component add rustfmt clippy
     - cargo fmt --check
-    - cargo clippy --all-targets -- -D warnings
+    # --locked on the first cargo invocation too: without it clippy resolves the
+    # dependencies and rewrites a Cargo.lock that has drifted from Cargo.toml,
+    # and the --locked commands after it then pass against what it just wrote
+    - cargo clippy --locked --all-targets -- -D warnings
     - cargo test --locked
     - cargo build --release --locked
   rules:
@@ -39,19 +47,33 @@ check:
 # runs only from a pipeline schedule, so set one up in the project settings
 audit:
   script:
-    - cargo install cargo-audit --locked
+    - cargo install cargo-audit --version $CARGO_AUDIT_VERSION --locked
     - cargo audit
     # reports dependencies that have drifted behind, without changing the lockfile
     - cargo update --dry-run
+  # its own cache, so the audit tool is not rebuilt on every schedule while
+  # still being written only by this schedule-only job. the pinned version is
+  # part of the key, so a bump fetches rather than reusing the old binary
+  cache:
+    key: audit-tools-$CARGO_AUDIT_VERSION
+    paths:
+      - .cargo/bin
+      - .cargo/registry
   rules:
     - if: $CI_PIPELINE_SOURCE == "schedule"
-  allow_failure: true
 
 # the msrv declared in Cargo.toml, so it fails when something needs a newer rustc
 msrv:
   image: rust:1.85
   script:
     - cargo build --locked
+  # its own key: artifacts built by another rustc are of no use to this job, and
+  # sharing one only has the two toolchains taking turns overwriting it
+  cache:
+    key: msrv-$CI_COMMIT_REF_SLUG
+    paths:
+      - .cargo/registry
+      - target
   rules:
     - if: $CI_PIPELINE_SOURCE == "schedule"
       when: never