check-rust-stable-version.yml

name: check-rust-stable-version

on:
  schedule:
    - cron: '0 0 * * 1-5' # Runs at midnight UTC (1 AM CET) Monday-Friday

permissions:
  contents: read

jobs:
  check:
    name: check-rust-stable-version/check
    runs-on: ubuntu-latest
    steps:
      # TODO: remove once GitHub runner images ship the CVE-2026-31431 kernel fix
      - name: Workaround CVE-2026-31431 (copy.fail)
        run: |
          echo "install algif_aead /bin/false" | sudo tee /etc/modprobe.d/disable-algif-aead.conf
          if lsmod | grep -q algif_aead; then
            sudo rmmod algif_aead || echo "WARNING: rmmod failed - module may be in use"
          elif modinfo algif_aead 2>/dev/null | grep -q builtin; then
            echo "WARNING: algif_aead built-in - modprobe.d blacklist has no effect"
          fi

      - name: Checkout Project
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          persist-credentials: "false"

      - name: Set up Rust
        uses: ./.github/actions/setup-rust-and-protoc
        with:
          rust-toolchain: stable
          rust-components: rustfmt, clippy, llvm-tools-preview
          rust-cache: "false"
          setup-protoc: "false"

      - name: Check Rust version
        env:
          GH_WORKSPACE: ${{ github.workspace }}
        run: |
          version="$(grep 'channel' "$GH_WORKSPACE/rust-toolchain.toml" | awk -F' = ' '{print $2}' | tr -d '"')"
          echo "Required version: $version"
          stable_version="$(rustc --version)"
          echo "Latest stable version: $stable_version"
          if echo "$stable_version" | grep -q "rustc $version"; then
            echo "Rust version is correct"
          else
            echo ":crab: **New Stable Rust version is available: $stable_version** :crab:" >> "$GITHUB_STEP_SUMMARY"
            echo "Please update the rust-toolchain.toml and the .env files with the new version" >> "$GITHUB_STEP_SUMMARY"
            exit 1
          fi