build(rust): raise DiskSage compiler baseline to 1.97.1

[seonghobae]

Problem

DiskSage declared Rust 1.88 in its Tauri package while test and release workflows relied on a floating stable compiler. That made the application compiler baseline old and non-reproducible.

Exact current state

• protected main: 7eb131c4b4ac628226b262d6406a663fc7dc632f
• exact current head: 13caeb04333e50e57c8a51a11b64aeb131c080b2
• branch is converged onto current protected main; the unique semantic delta remains the Rust baseline, workflow, changelog, and contract files
• hosted required checks are queued or still running for this exact head; predecessor evidence is not reused
• PR is ready for review and remains blocked until current checks and independent protected approvals are present

Changes

• add root rust-toolchain.toml pinned to Rust 1.97.1
• raise the non-published application's rust-version to 1.97.1
• make primary and embedded-LLM Test jobs install and report the exact compiler
• preserve only supported weekly Dependabot cargo and github-actions tracking; no unsupported rust-toolchain ecosystem is declared
• add a Rust contract covering local, CI, and root-governed release compiler selection
• record the upgrade in the changelog

Current review repair

The structured contract reader previously accepted required YAML keys at arbitrary descendant depth. A malicious or accidental nested with.nested.toolchain, nested Dependabot metadata.directory, or schedule.nested.interval could therefore satisfy a governance test even though the actual direct mapping was wrong.

The current head was repaired test-first:

• the RED regression adds nested workflow and Dependabot decoys that the predecessor reader incorrectly accepted;
• workflow with and toolchain keys must now be immediate children at the expected indentation;
• Dependabot directory and open-pull-requests-limit must now be direct update-item fields;
• schedule.interval must be an immediate child of the direct schedule mapping;
• the addressed CodeRabbit review thread is resolved only after the exact source contained these direct-mapping guards.

Pinned Rust 1.97.1 local documentation tests pass on this exact head; the full hosted exact-head Test, coverage, security, and independent review gates remain required.

Evidence contract

The exact-head Test must prove Tauri/Rust tests, cloud/archive CLI proofs, embedded llama.cpp CPU build, frontend tests/build, and compiler contract tests under the pinned compiler. Release must independently prove packaging from the same exact source without relying on restored Rust target artifacts. Security/SAST and every applicable central workflow must also be current.

This intentionally raises DiskSage's application MSRV from 1.88 to 1.97.1. DiskSage is publish = false, so it does not alter a public crate compatibility promise. No storage, cloud, authorization, model, UI, or data semantics are intentionally changed.

Required before merge

Keep Draft until the unchanged exact head satisfies every live required workflow, zero valid unresolved findings, fresh protected-main ancestry, actual review governance, and repository-wide exact 100% owned-production region/statement-equivalent, branch, function, and line coverage without exclusions or threshold weakening. Pending, queued, skipped-required, failed, stale, predecessor, synthetic, diagnostic-only, status-only, model-only, author-only, or no-source evidence is non-passing.

Summary by CodeRabbit

• 개선 사항

  • 애플리케이션, 로컬 개발 환경, CI 및 릴리스 빌드에서 Rust 1.97.1을 사용하도록 통일했습니다.
  • Rust 형식 검사와 정적 분석 도구를 기본 개발 환경 및 CI에 포함했습니다.
  • Rust 도구체인 업데이트를 매주 자동으로 확인합니다.

• 테스트

  • 프로젝트와 CI의 Rust 버전 및 도구체인 설정 일관성을 자동으로 검증합니다.
  • 중첩된 설정을 잘못 인식하지 않도록 구성 검증을 강화했습니다.

[coderabbitai]

Warning

Review limit reached

Next included review available in 38 minutes.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 6adfd4c0-84a9-4939-b0b9-ebbf2cb7bc6d

📥 Commits

Reviewing files that changed from the base of the PR and between 6f7c73c and 11322fd.

📒 Files selected for processing (6)

• .github/scripts/verify-release-artifacts.sh
• .github/workflows/release.yml
• .github/workflows/test.yml
• CHANGELOG.md
• src-tauri/Cargo.toml
• src-tauri/tests/rust_toolchain_contract.rs

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: c65ed92e-4223-4361-b19c-695c790a44dc

📥 Commits

Reviewing files that changed from the base of the PR and between aed6312 and 6f7c73c.

📒 Files selected for processing (1)

• src-tauri/tests/rust_toolchain_contract.rs

🚧 Files skipped from review as they are similar to previous changes (1)

• src-tauri/tests/rust_toolchain_contract.rs

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

프로젝트의 Rust 컴파일러 기준을 1.97.1로 통일했습니다. 로컬 툴체인, Cargo, CI, Dependabot 설정과 계약 테스트를 갱신했습니다.

Changes

Rust 툴체인 업그레이드

Layer / File(s)	Summary
Rust 툴체인 및 최소 버전 계약 rust-toolchain.toml, src-tauri/Cargo.toml	루트 툴체인을 Rust 1.97.1, minimal 프로필, clippy, rustfmt로 설정했습니다. Cargo의 최소 Rust 버전도 1.97.1로 변경했습니다.
CI 및 업데이트 자동화 정렬 .github/workflows/test.yml, .github/dependabot.yml, CHANGELOG.md	두 Rust 관련 작업에서 stable 대신 Rust 1.97.1을 사용합니다. 실행 버전을 상세 형식으로 출력합니다. Dependabot에 rust-toolchain의 주간 업데이트와 PR 제한을 추가했습니다. 변경 로그에 새 컴파일러 기준을 기록했습니다.
자동화 설정 계약 검증 src-tauri/tests/rust_toolchain_contract.rs	계약 테스트가 TOML과 YAML의 직접 하위 설정을 해석합니다. 로컬·CI·릴리스 설정과 Dependabot의 Rust 버전 및 업데이트 정책을 검증합니다. 중첩된 값과 무관한 설정을 오인하지 않는 테스트를 추가했습니다.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Merge Risk: 🟡 Moderate · up to 6f7c7

This PR raises DiskSage’s Rust compiler baseline to 1.97.1 and changes CI and release compiler selection. The exact-head Test, Release, Security Scan, and SAST checks are still queued and non-passing, so merge should wait until those required validations complete.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 13 functions across 1 files.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 DiskSage의 Rust 컴파일러 기준을 1.97.1로 상향하는 이 풀 리퀘스트의 주요 변경 사항을 정확히 요약합니다.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch agent/rust-toolchain-refresh-2026-08-19

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[seonghobae]

@OpenCode review current head 321c451. The prior structural-reader finding is already implemented in 4fe53ed and is present in the current head; please re-evaluate only current-head evidence.

[seonghobae]

@OpenCode review current head 321c451

[seonghobae]

The exact-head checks are green at 321c4518399129f5dd78f8a7bc5e68edc8c3e2b8. The branch is now marked ready for normal independent review; no self-approval or merge bypass is used.

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 1 additional finding.

[seonghobae]

The exact-head source and all required checks are green at 321c4518399129f5dd78f8a7bc5e68edc8c3e2b8; this PR is now ready for independent protected review. No self-approval or bypass is used.

[seonghobae]

@OpenCode review current head 321c451

[seonghobae]

Reviewed exact current head aed6312b25a169fbc9edc32b6417e9f05b17f501 against protected main. The latest commits 4048b94/aed6312 bind YAML toolchain and Dependabot values to direct mappings and add nested-decoy regressions, addressing the prior CodeRabbit findings. Exact build matrix, Test, security, Semgrep, Strix, Noema, OpenCode, coverage, and Devin checks are terminal-success where reported; no current-head defect found. Please run/complete the normal independent review and protected merge gates; no self-approval or bypass.

[seonghobae]

Validated the latest Devin concern against current GitHub documentation: rust-toolchain is a supported Dependabot ecosystem, including updates to rust-toolchain.toml/rust-toolchain channels. The current entry is therefore valid and intentionally retained; no source change is warranted. Reference: https://docs.github.com/en/enterprise-cloud@latest/code-security/reference/supply-chain-security/supported-ecosystems-and-repositories#rust-toolchain. Exact head remains 6f7c73ccd6af3e177e7c3a643c244e76071c6184.

[seonghobae]

OpenCode current-head evidence (2026-08-24):

• HEAD 16416cc merges current main to clear the prior DIRTY state, preserving both the Rust baseline and current provider/evidence workflow changes.
• The Windows CI Rust action is now explicitly pinned to 1.97.1; the contract counts and validates all 3 CI bootstrap actions and all 3 release bootstrap actions.
• Pinned Rust 1.97.1: cargo test --manifest-path src-tauri/Cargo.toml --test rust_toolchain_contract → 4 passed.
• git diff --check passes.

The PR remains draft/blocked with required review and hosted checks pending; no merge claimed.

[seonghobae]

The PR is now marked ready for review at exact HEAD 13caeb0; prior draft wording above is superseded. Protected merge gates still require current hosted checks and the independent review approvals.

[seonghobae]

Exact current head 13caeb04333e50e57c8a51a11b64aeb131c080b2 remains unchanged.

Local pinned evidence: RUSTC=$(rustup which rustc --toolchain 1.97.1), RUSTDOC=$(rustup which rustdoc --toolchain 1.97.1), rustup run 1.97.1 cargo test --workspace --all-features --doc passed (0 passed, 0 failed). The earlier full run reached 714 passed before environment/toolchain failures; the failure was from rustdoc 1.96.0 loading 1.97.1 artifacts, not a source assertion.

The non-doc full matrix was intentionally stopped after a long per-helper rebuild; no merge/readiness claim. Hosted checks and independent approvals remain required.

[seonghobae]

Current-head Strix failure is provider infrastructure, not a source finding. Job 97338769912 for HEAD 13caeb04333e50e57c8a51a11b64aeb131c080b2 failed closed after NVIDIA NIM HTTP 429 rate limits; the fallback openai-direct/gpt-5.6-luna then returned HTTP 404, and no structured vulnerability report was produced. This is not actionable as a code change. I will re-run the failed job for same-head evidence; protected merge gates remain blocked and no merge/readiness claim is made.

[seonghobae]

Follow-up: both gh run rerun 32696254720 --failed and the REST actions/runs/32696254720/rerun-failed endpoint returned HTTP 404 for this historical run, so GitHub does not permit an in-place rerun. No code change was made; a future same-head workflow dispatch/retry can provide new provider evidence when the run is available.

[seonghobae]

Hosted failure classification: Strix is provider-gated and remains separate from source correctness; no source mutation made. Keep the documented provider retry path and protected review requirements.

[devin-ai-integration]

Devin Review found 0 new potential issues.

[devin-ai-integration]

Devin Review found 2 new potential issues.