build(rust): pin all product and release lanes to 1.97.1

.github/dependabot.yml

@@ -1,5 +1,15 @@
 version: 2
 updates:
+  - package-ecosystem: "rust-toolchain"
+    directory: "/"
+    target-branch: "develop"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 1
+    labels:
+      - "dependencies"
+      - "rust"
+
   - package-ecosystem: "npm"
     directory: "/"
     target-branch: "develop"

.github/workflows/build-baseline.yml

@@ -47,10 +47,10 @@ jobs:
         with:
           version: "0.8.6"
           enable-cache: false
-      - name: Install Rust stable
-        run: rustup toolchain install stable --profile minimal
+      - name: Install Rust 1.97.1
+        run: rustup toolchain install 1.97.1 --profile minimal
       - name: Add Windows target
-        run: rustup target add $env:BANDSCOPE_TARGET_TRIPLE --toolchain stable
+        run: rustup target add $env:BANDSCOPE_TARGET_TRIPLE --toolchain 1.97.1
       - name: Verify Windows antivirus baseline
         shell: pwsh
         run: |
@@ -142,10 +142,10 @@ jobs:
         with:
           version: "0.8.6"
           enable-cache: false
-      - name: Install Rust stable
-        run: rustup toolchain install stable --profile minimal
+      - name: Install Rust 1.97.1
+        run: rustup toolchain install 1.97.1 --profile minimal
       - name: Add Windows arm target
-        run: rustup target add $env:BANDSCOPE_TARGET_TRIPLE --toolchain stable
+        run: rustup target add $env:BANDSCOPE_TARGET_TRIPLE --toolchain 1.97.1
       - name: Verify Windows antivirus baseline
         shell: pwsh
         run: |
@@ -248,10 +248,10 @@ jobs:
         with:
           version: "0.8.6"
           enable-cache: false
-      - name: Install Rust stable
-        run: rustup toolchain install stable --profile minimal
+      - name: Install Rust 1.97.1
+        run: rustup toolchain install 1.97.1 --profile minimal
       - name: Add macOS Intel target
-        run: rustup target add "$BANDSCOPE_TARGET_TRIPLE" --toolchain stable
+        run: rustup target add "$BANDSCOPE_TARGET_TRIPLE" --toolchain 1.97.1
       - name: Install create-dmg
         run: brew install create-dmg
       - name: Install node dependencies
@@ -306,10 +306,10 @@ jobs:
         with:
           version: "0.8.6"
           enable-cache: false
-      - name: Install Rust stable
-        run: rustup toolchain install stable --profile minimal
+      - name: Install Rust 1.97.1
+        run: rustup toolchain install 1.97.1 --profile minimal
       - name: Add macOS arm target
-        run: rustup target add "$BANDSCOPE_TARGET_TRIPLE" --toolchain stable
+        run: rustup target add "$BANDSCOPE_TARGET_TRIPLE" --toolchain 1.97.1
       - name: Install create-dmg
         run: brew install create-dmg
       - name: Install node dependencies

.github/workflows/ci.yml

@@ -36,8 +36,8 @@ jobs:
         run: npm ci
       - name: Sync Python dependencies
         run: uv sync --project services/analysis-engine --group dev --frozen
-      - name: Install stable Rust toolchain
-        run: rustup toolchain install stable --profile minimal
+      - name: Install Rust 1.97.1 toolchain
+        run: rustup toolchain install 1.97.1 --profile minimal
       - name: Build and install Rust numeric extension
         run: |
           VENV_PY="$PWD/services/analysis-engine/.venv/bin/python"
@@ -58,13 +58,13 @@ jobs:
         with:
           node-version: 22.22.3
           cache: npm
-      - name: Install stable Rust toolchain
-        run: rustup toolchain install stable --profile minimal
+      - name: Install Rust 1.97.1 toolchain
+        run: rustup toolchain install 1.97.1 --profile minimal
       - name: Install node dependencies
         run: npm ci
       - name: Build frontend
         run: npm run build --workspace @bandscope/desktop
       - name: Check Tauri shell
-        run: cargo +stable check --manifest-path apps/desktop/src-tauri/Cargo.toml --locked
+        run: cargo +1.97.1 check --manifest-path apps/desktop/src-tauri/Cargo.toml --locked
       - name: Test Tauri shell
-        run: cargo +stable test --manifest-path apps/desktop/src-tauri/Cargo.toml --locked
+        run: cargo +1.97.1 test --manifest-path apps/desktop/src-tauri/Cargo.toml --locked

.github/workflows/release.yml

@@ -40,8 +40,8 @@ jobs:
         with:
           version: "0.8.6"
           enable-cache: false
-      - name: Install Rust stable
-        run: rustup toolchain install stable --profile minimal
+      - name: Install Rust 1.97.1
+        run: rustup toolchain install 1.97.1 --profile minimal
       - name: Install node dependencies
         run: npm ci
       - name: Sync Python dependencies

.github/workflows/security-audit.yml

@@ -43,10 +43,10 @@ jobs:
         run: uv sync --project services/analysis-engine --group dev --frozen
       - name: Audit Python dependencies
         run: uv run --project services/analysis-engine --with pip-audit==2.8.0 pip-audit --local --strict
-      - name: Install stable Rust toolchain
-        run: rustup toolchain install stable --profile minimal
+      - name: Install Rust 1.97.1 toolchain
+        run: rustup toolchain install 1.97.1 --profile minimal
       - name: Install cargo-audit
-        run: cargo +stable install cargo-audit --locked
+        run: cargo +1.97.1 install cargo-audit --locked
       - name: Audit Rust dependencies
         working-directory: apps/desktop/src-tauri
-        run: cargo +stable audit
+        run: cargo +1.97.1 audit

CHANGELOG.md

@@ -7,6 +7,10 @@
 - Display the analyzed song tempo (BPM) as a badge in the rehearsal workspace.
 - 각 합주 역할(Role)별 개인 연습 진행도를 0~100% 범위로 기록 및 시각화할 수 있는 연습 진척도(`practiceProgress`) 트래커 기능 추가. UI 컨트롤(슬라이더 및 +/- 버튼)과 한/영 다국어 지원 포함.
 
+### Changed
+
+- Pin repository-owned Rust build, audit, release, and native packaging evidence to Rust 1.97.1, and fail closed when required Rust commands are hidden in non-executing text, borrowed from another workflow/job, or chained through shell control flow that can mask their exit status.
+
 ## [0.1.3] - 2026-04-29
 
 ### Fixed

docs/doctoring/rust-toolchain-freshness.md

@@ -0,0 +1,51 @@
+# Rust toolchain freshness and reproducibility
+
+## Decision
+
+BandScope pins Rust `1.97.1` as the repository build compiler. The root
+`rust-toolchain.toml`, product CI, release preflight, dependency audit, and
+Windows/macOS amd64/arm64 packaging workflows all use that exact point release.
+A floating `stable` selector is not accepted because it can change scientific,
+security, and release evidence without a repository diff.
+
+The compiler pin does not add or raise `package.rust-version` in the workspace.
+This change governs BandScope's reviewed build environment; it does not create a
+new downstream minimum-supported-Rust promise for reusable crates.
+
+GitHub Dependabot monitors the root manifest through the `rust-toolchain`
+ecosystem against the protected `develop` branch. GitHub documents this
+integration as a Dependabot version-update capability rather than a Rust
+security-update feed. A future compiler update must therefore arrive as a
+reviewable pull request and pass the unchanged-head Windows, macOS,
+analysis-engine, Tauri, release-preflight, audit, coverage, and supply-chain
+gates. GitHub's platform-level default cooldown for Dependabot version updates
+is additional noise control; it is not treated as a repository security or
+freshness guarantee.
+
+`scripts/checks/verify_rust_toolchain.py` runs in the canonical quickcheck and
+fails when any executable workflow reintroduces `rustup toolchain install
+stable`, `cargo +stable`, or `--toolchain stable`. The same guard binds
+`directory`, target branch, and schedule evidence to the actual
+`rust-toolchain` Dependabot lane so an unrelated ecosystem entry cannot satisfy
+the compiler-update policy.
+
+Required Rust command evidence is also bound to one inline executable `run:`
+step whose exit status cannot be replaced by shell chaining, pipelines, or
+background control operators. Arguments such as `--manifest-path`, `--locked`,
+and an explicit target triple remain valid, but forms such as `|| true`,
+`| cat`, or `; true` fail closed. This prevents an unsuccessfully installed,
+checked, tested, or audited Rust toolchain from becoming success-shaped policy
+evidence merely because a later shell command returns zero.
+
+## References
+
+GitHub. (2025, August 19). *Dependabot now supports Rust toolchain updates*.
+GitHub Changelog.
+https://github.blog/changelog/2025-08-19-dependabot-now-supports-rust-toolchain-updates/
+
+GitHub. (2026, July 14). *Dependabot version updates introduce default package
+cooldown*. GitHub Changelog.
+https://github.blog/changelog/2026-07-14-dependabot-version-updates-introduce-default-package-cooldown/
+
+The Rust Release Team. (2026, July 16). *Announcing Rust 1.97.1*. Rust Blog.
+https://blog.rust-lang.org/2026/07/16/Rust-1.97.1/

rust-toolchain.toml

@@ -0,0 +1,3 @@
+[toolchain]
+channel = "1.97.1"
+profile = "minimal"