[aaron-kumo]

What

Pin the rust version (1.99.1) and replace dtolnay/rust-toolchain with a local action that installs the pinned toolchain with the runner's own rustup and makes it the default. scripts/diskgraph reads the same file for the wheel settings and cache key.

Why

NVIDIA's enterprise Actions allowlist permits dtolnay/rust-toolchain only at its current SHA. Dependabot's bump (#18) makes every workflow that uses it fail at startup, including testing.yml, kumo-engine-pr.yml, playwright_ui.yml and the required kumo-core-gpu.yml, and every future bump would do the same. It's better to rely on native rustup than some external action.

Behavior changes

• Tests and clippy move from 1.98.1 to 1.99.1, the stable release that PR and release wheels already build with. Wheels now stay on that pinned version instead of following the runner image.
• Clippy 1.99 flags the #[must_use] that async-trait generates on DatasetRegistry and GraphStorage, so double_must_use is allowed there until the 1.100 bump.
• Backend Docker images build DiskGraph with 1.99.1, because the toml travels with packages/diskgraph.
• Developers building under packages/diskgraph get 1.99.1, which rustup 1.28.1 or later installs automatically.
• Every Rust cache key changes once.

Change map and validation

[aaron-kumo]

Change map

File	Function / scope	What changed	Why
packages/diskgraph/rust-toolchain.toml	New file	Pin Rust 1.99.1.	One source for the version, shared by CI, wheels, Docker and developers.
.github/actions/rust-toolchain/action.yml	New composite action	Install the pinned toolchain with the runner's rustup, make it the default, add components, and export CARGO_HOME, CARGO_INCREMENTAL=0 and CARGO_TERM_COLOR=always.	Replaces dtolnay/rust-toolchain; the exports keep build settings and rust-cache keys as before.
.github/workflows/_diskgraph-wheel.yml, .github/workflows/kumo-engine-pr.yml, .github/workflows/kumo-engine-wheel.yml, .github/workflows/testing.yml	Rust setup steps	Use the local action.	The allowlist rejects the action's new SHA (#18).
scripts/diskgraph	wheel_rust_toolchain, cmd_wheel_env, cmd_wheel_key	Read the toolchain from the toml.	Keep the wheel settings and cache key on the pin.
packages/diskgraph/diskgraph-core/src/dataset.rs, packages/diskgraph/diskgraph-core/src/storage.rs	DatasetRegistry, GraphStorage	#[allow(clippy::double_must_use)].	Clippy 1.99 flags async-trait's generated #[must_use]; clippy 1.100 fixes this.

Requested change: stop using dtolnay/rust-toolchain, which fails to start on #18, and pin the latest stable instead of 1.98.1.

Verification: actionlint, shellcheck, the workflow security policy, and the change-map checker pass. Rust CI and the GPU check pass, and the manual kumo-engine-wheel.yml run built all four platforms.

Out of scope: the 1.100 bump, which removes the double_must_use allows.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

• Last reviewed commit: 56f4874

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• Resume reviews
• Trigger review

No actionable comments were generated in the recent review.

Walkthrough

The change pins the diskgraph Rust toolchain to 1.99.1 and adds a local composite action to install it. Wheel settings read the configured channel and include it in the cache key. Wheel and testing workflows use the local action. The diskgraph core traits allow the double_must_use lint.

Merge Risk: Minimal · up to 56f48

No actionable merge-blocking risk is established from the available evidence.

Pre-merge checks: 2 · 1

Failed checks: 1 inconclusive

Check name	Status	Explanation	Resolution
Change Map Design Review		The required PR conversation comment beginning <!-- kumo-pr-change-map --> is not available. The checkout contains only the repository guidance that requires this comment (`docs/development/review.m…	Provide the full conversation comment beginning <!-- kumo-pr-change-map --> or enable PR conversation retrieval, then reassess each proposed change against the repository diff and consumers.

Passed checks: 2 passed

Check name	Status	Explanation
Pr Size		The pull request changes 9 files. This does not exceed the failure threshold of 40 files.
Public Resource Access		The pull request adds no inaccessible external URL or external repository reference. It replaces the external dtolnay/rust-toolchain references with the local ./.github/actions/rust-toolchain acti…

Full details: Public Resource Access

Explanation

The pull request adds no inaccessible external URL or external repository reference. It replaces the external dtolnay/rust-toolchain references with the local ./.github/actions/rust-toolchain action. The new Rust toolchain source is the public Rust 1.99.1 channel, and its manifest and checksum were accessible anonymously from static.rust-lang.org with HTTP 200.

Full details: Change Map Design Review

Explanation

The required PR conversation comment beginning <!-- kumo-pr-change-map --> is not available. The checkout contains only the repository guidance that requires this comment (docs/development/review.md:7-13), while the supplied PR description provides only a link and summary. The code diff is inspectable, but it cannot establish whether the proposed change map documented the observed failure, necessity, focused verification, and stopping condition in that same comment.

Resolution

Provide the full conversation comment beginning <!-- kumo-pr-change-map --> or enable PR conversation retrieval, then reassess each proposed change against the repository diff and consumers.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Recent review info

Run configuration

• Source mode: Auto
• Repository: NVIDIA/kumo-engine
• Branch: rust-toolchain-toml
• File: .coderabbit.yaml
• Commit: 56f4874
• Layers: Repository YAML
• Review profile: QUIET
• Plan: Enterprise
• Run ID: ac4a813a-5c78-428f-9a94-2784d16ea2c1

Commits

Reviewing files that changed from the base of the PR and between 5d17c1d and 56f4874.

Files selected for processing: 4

• .github/workflows/_diskgraph-wheel.yml
• .github/workflows/kumo-engine-pr.yml
• .github/workflows/kumo-engine-wheel.yml
• .github/workflows/testing.yml

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 9 remain after this review.

[coderabbitai]

Follow-up Comments

Run the shared backend wheel build from the staged source directory.

5-7: Minor · Functional Correctness · Quick win

Run the shared backend wheel build from the staged source directory.

The CPU and GPU builders invoke docker/build_diskgraph_wheel from /home/${USERNAME}. Its cargo update --manifest-path call does not use the staged rust-toolchain.toml, so both backend paths perform a Cargo operation with the Docker-installed stable toolchain instead of 1.98.1.

Change the shared script so its Cargo and wheel-build operations run from source_dir.

Suggested fix

     if [ ! -f "${source_dir}/pyproject.toml" ]; then
         echo "No staged DiskGraph pyproject.toml found at ${source_dir}" >&2
         exit 1
     fi
+    cd "$source_dir"
     ensure_cargo

Open the source location

Review info

Run configuration

• Source mode: Auto
• Repository: NVIDIA/kumo-engine
• Branch: rust-toolchain-toml
• File: .coderabbit.yaml
• Commit: e8c09ca
• Layers: Repository YAML
• Review profile: QUIET
• Plan: Enterprise
• Run ID: 3d2be61f-7bd9-46fb-a954-e577d56b69c1

Commits

Reviewing files that changed from the base of the PR and between 70637d3 and e8c09ca.

Files selected for processing: 7

• .github/actions/rust-toolchain/action.yml
• .github/workflows/_diskgraph-wheel.yml
• .github/workflows/kumo-engine-pr.yml
• .github/workflows/kumo-engine-wheel.yml
• .github/workflows/testing.yml
• packages/diskgraph/rust-toolchain.toml
• scripts/diskgraph

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 10 remain after this review.

[coderabbitai]

Nitpick comments: 1

.github/workflows/testing.yml: 1

370-370: Trivial · Security & Privacy · Quick win

Use the $/ self-repository reference for the local Rust toolchain action.

./.github/actions/rust-toolchain resolves from the job workspace. $/.github/actions/rust-toolchain resolves from this repository at the running commit and does not need a checkout. The zizmor self-repository audit flags ./ references to in-repo actions and recommends $/.

The current checkout order means both forms load the same action file, so this change does not alter the toolchain that gets installed. Apply the same edit to the other new rust-toolchain references in _diskgraph-wheel.yml, kumo-engine-pr.yml, and kumo-engine-wheel.yml.

Proposed change

-      - uses: ./.github/actions/rust-toolchain
+      - uses: $/.github/actions/rust-toolchain

Apply the same change to the diskgraph-clippy job at line 405.

Review info

Run configuration

• Source mode: Auto
• Repository: NVIDIA/kumo-engine
• Branch: rust-toolchain-toml
• File: .coderabbit.yaml
• Commit: 9fb7ae5
• Layers: Repository YAML
• Review profile: QUIET
• Plan: Enterprise
• Run ID: 4b545f62-1c3a-4ba2-a7f4-2035c2ba7d81

Commits

Reviewing files that changed from the base of the PR and between 41a9c5d and 9fb7ae5.

Files selected for processing: 1

• .github/workflows/testing.yml

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 11 remain after this review.