fix(cargo-anvil): address validation follow-ups

[martin-kolinek]

🤖 Follow-up to #109.

Summary

• keep MSRV and Cargo-tool prerequisite validation read-only by disabling rustup auto-install and preserving failed cargo install --list diagnostics
• report the selected stable toolchain and actionable setup command when default-component probing cannot resolve a sysroot
• replace the two conditional PR Job reusable-workflow callers with one event-aware caller, eliminating the permanently skipped duplicate check

Review follow-ups

Addresses the deferred Copilot findings from:

• fix(cargo-anvil): make stable toolchains deterministic #109 (comment)
• fix(cargo-anvil): make stable toolchains deterministic #109 (comment)

The single caller intentionally grants statuses: write and pull-requests: write to merge-group runs as well. All write operations remain guarded to same-repository pull_request events.

[Copilot]

Pull request overview

This PR is a follow-up to the stable/MSRV toolchain determinism work in cargo-anvil, tightening validation behavior (keep it read-only and preserve diagnostics) and simplifying the GitHub Actions PR root workflow so PR/merge-queue runs emit a single “PR Job” check context.

Changes:

• Make MSRV/tool prerequisite validation read-only by disabling rustup auto-install, while preserving and surfacing cargo install --list failure diagnostics.
• Improve error messaging when sysroot probing can’t resolve the selected stable toolchain (including actionable setup guidance).
• Replace the duplicated conditional PR/merge-group root workflow callers with one event-aware caller (base SHA selection + conditional status publishing).

Reviewed changes

Copilot reviewed 14 out of 15 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
justfiles/anvil/tools.just	Preserve cargo install --list stderr + exit code and emit actionable diagnostics; refine default-toolchain sysroot error.
justfiles/anvil/checks/msrv-test.just	Disable RUSTUP_AUTO_INSTALL during MSRV prereq validation and preserve the real cargo exit code.
crates/cargo-anvil/tests/snapshots/snapshots__local_only.snap	Update snapshots for the adjusted justfile validation behavior.
crates/cargo-anvil/tests/snapshots/snapshots__github_backend.snap	Update snapshots for unified PR root caller and prereq validation changes.
crates/cargo-anvil/tests/snapshots/snapshots__ado_backend.snap	Update snapshots for prereq validation and tool checks output.
crates/cargo-anvil/tests/recipe_contracts.rs	Extend test harness to log RUSTUP_AUTO_INSTALL, simulate cargo install --list, and add coverage for the new diagnostics.
crates/cargo-anvil/templates/justfiles/anvil/tools.just	Keep template in sync with updated tool validation and diagnostics behavior.
crates/cargo-anvil/templates/justfiles/anvil/checks/msrv-test.just	Keep template in sync with updated MSRV prereq validation behavior.
crates/cargo-anvil/templates/github/pr-root-workflow.yml	Update generated root workflow template to a single event-aware caller.
crates/cargo-anvil/templates/github/pr-impl-workflow.yml	Comment updates to reflect root-caller responsibility for permission ceilings.
crates/cargo-anvil/src/anvil/artifacts/github.rs	Update assertions validating the generated workflow shape (single caller, conditional status publishing).
crates/cargo-anvil/docs/design/github.md	Update design documentation to match the new single-caller workflow model and its tradeoffs.
.github/workflows/anvil-pr.yml	Apply the single event-aware caller pattern to the repo’s generated workflow.
.github/workflows/anvil-pr-impl.yml	Comment updates consistent with the new caller model; behavior remains guarded by event/repo conditions.
.anvil.lock	Refresh checksums to reflect regenerated workflow/justfile artifacts.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Codecov Comments Bot (codecov-commenter)]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.6%. Comparing base (cad5174) to head (c53698e).
⚠️ Report is 2 commits behind head on main.

❌ Your project status has failed because the head coverage (97.6%) is below the target coverage (100.0%). You can increase the head coverage or adjust the target coverage.

Additional details and impacted files

@@          Coverage Diff          @@
##            main    #131   +/-   ##
=====================================
  Coverage   97.6%   97.6%           
=====================================
  Files        298     298           
  Lines      67348   67348           
=====================================
+ Hits       65763   65766    +3     
+ Misses      1585    1582    -3     

Flag	Coverage Δ
linux	97.6% <ø> (?)
linux-arm	97.6% <ø> (?)
windows	97.7% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

🟢 Approval recommended

The changes are consistent across sources/templates/snapshots, add targeted regression tests for the validation behavior, and preserve the documented event-guarding for write operations.

Review details

• Files reviewed: 14/15 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Copilot]

🟢 Approval recommended

The changes are cohesive, covered by targeted regression tests, and the remaining feedback is limited to minor message/wording clarity.

Review details

• Files reviewed: 14/15 changed files
• Comments generated: 3
• Review effort level: Lite

[Copilot]

🔵 Needs a closer look

The new “preserve diagnostics” logic uses Out-String, which can reformat/wrap output and should be adjusted to join lines directly to truly preserve Cargo’s diagnostics.

Review details

Suppressed comments (2)

Previously missed (2) — in code that hasn't changed since the last review.

crates/cargo-anvil/templates/justfiles/anvil/tools.just:503

• $listOutput | Out-String can reformat/wrap long lines, which undermines the goal of preserving the original cargo install --list diagnostics. Prefer joining the captured lines directly so the diagnostic text matches what Cargo emitted.
  justfiles/anvil/tools.just:503
• $listOutput | Out-String can reformat/wrap long lines, which undermines the goal of preserving the original cargo install --list diagnostics. Prefer joining the captured lines directly so the diagnostic text matches what Cargo emitted.

• Files reviewed: 16/17 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Copilot]

🟢 Approval recommended

The changes preserve the intended security/permission guards while improving validation determinism and diagnostics, and the updated tests/docs/snapshots align with the new behavior.

Review details

• Files reviewed: 16/17 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Copilot]

🟢 Approval recommended

The changes are consistent across templates/generated outputs, add targeted regression coverage, and keep write operations guarded while removing redundant workflow callers.

Review details

• Files reviewed: 16/17 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Copilot]

🟡 Changes recommended

The root workflow now grants write-capable GITHUB_TOKEN permissions on merge_group runs, which increases security risk for any repository-controlled commands executed during merge-queue validation.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

• Files reviewed: 16/17 changed files
• Comments generated: 1
• Review effort level: Lite

[Copilot]

🟡 Changes recommended

The anvil-run-group composite action now withholds GITHUB_TOKEN on non-pull_request events, but it is also used by scheduled workflows where checks like anvil-aprz expect CI to inject a token (to avoid unauthenticated GitHub API rate limiting and potential long blocking).

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

• Files reviewed: 18/19 changed files
• Comments generated: 1
• Review effort level: Lite

[Copilot]

🟢 Approval recommended

No correctness, security, or contract-drift issues were identified in the changed scripts/workflows, and the PR updates tests/docs/snapshots in lockstep with the behavior changes.

Review details

• Files reviewed: 16/17 changed files
• Comments generated: 0 new
• Review effort level: Lite