Use --locked with cargo install (#1216)

This will prevent installation issues in case dependencies break semver
promise

Fixes #1211

.cargo-husky/hooks/pre-push

@@ -16,7 +16,7 @@ set -e
 if ! command -v just > /dev/null; then
     echo "Command 'just' is not installed. See https://github.com/casey/just#readme for installation instructions, or use"
     echo ""
-    echo "  cargo install just"
+    echo "  cargo install just --locked"
     echo ""
     exit 1
 fi

.github/workflows/ci.yml

@@ -269,7 +269,7 @@ jobs:
         run: |
           set -x
           sudo apt-get install -y dpkg dpkg-dev liblzma-dev
-          cargo install cargo-deb
+          cargo install cargo-deb --locked
           cargo deb -v -p martin --output target/debian/debian-x86_64.deb
           mkdir -p target_releases
           mv target/debian/debian-x86_64.deb target_releases/

docs/src/development.md

@@ -30,7 +30,7 @@ sudo apt install -y  build-essential pkg-config jq file
 Install [Just](https://github.com/casey/just#readme) (improved makefile processor). Note that some Linux and Homebrew distros have outdated versions of Just, so you should install it from source:
 
 ```shell, ignore
-cargo install just
+cargo install just --locked
 ```
 
 When developing MBTiles SQL code, you may need to use `just prepare-sqlite` whenever SQL queries are modified. Run `just` to see all available commands.

docs/src/installation.md

@@ -21,7 +21,7 @@ You can download martin from [GitHub releases page](https://github.com/maplibre/
 If you [install Rust](https://www.rust-lang.org/tools/install), you can build martin from source with Cargo:
 
 ```shell
-cargo install martin
+cargo install martin --locked
 martin --help
 ```
 

docs/src/tools.md

@@ -12,6 +12,6 @@ Martin project contains additional tooling to help manage the data servable with
 
 Use `mbtiles --help` to see a list of available commands, and `mbtiles <command> --help` to see help for a specific command.
 
-This tool can be installed by compiling the latest released version with `cargo install mbtiles`, or by downloading a pre-built binary from the [releases page](https://github.com/maplibre/martin/releases/latest).
+This tool can be installed by compiling the latest released version with `cargo install mbtiles --locked`, or by downloading a pre-built binary from the [releases page](https://github.com/maplibre/martin/releases/latest).
 
 The `mbtiles` utility builds on top of the [MBTiles specification](https://github.com/mapbox/mbtiles-spec). It adds a few additional conventions to ensure that the content of the tile data is valid, and can be used for reliable diffing and patching of the tilesets.

justfile

@@ -348,10 +348,10 @@ cargo-install $COMMAND $INSTALL_CMD="" *ARGS="":
     set -eu
     if ! command -v $COMMAND > /dev/null; then
         if ! command -v cargo-binstall > /dev/null; then
-            echo "$COMMAND could not be found. Installing it with    cargo install ${INSTALL_CMD:-$COMMAND} {{ ARGS }}"
-            cargo install ${INSTALL_CMD:-$COMMAND} {{ ARGS }}
+            echo "$COMMAND could not be found. Installing it with    cargo install ${INSTALL_CMD:-$COMMAND} --locked {{ ARGS }}"
+            cargo install ${INSTALL_CMD:-$COMMAND} --locked {{ ARGS }}
         else
-            echo "$COMMAND could not be found. Installing it with    cargo binstall ${INSTALL_CMD:-$COMMAND} {{ ARGS }}"
-            cargo binstall ${INSTALL_CMD:-$COMMAND} {{ ARGS }}
+            echo "$COMMAND could not be found. Installing it with    cargo binstall ${INSTALL_CMD:-$COMMAND} --locked {{ ARGS }}"
+            cargo binstall ${INSTALL_CMD:-$COMMAND} --locked {{ ARGS }}
         fi
     fi