Fix format check and pin the rustfmt nightly

.github/actions/macos/action.yml

@@ -28,7 +28,7 @@ runs:
 
         rustup toolchain install
         rustup target add wasm32-unknown-unknown
-        rustup component add rustfmt --toolchain nightly
+        rustup toolchain install nightly-2026-08-31 --profile minimal --component rustfmt
         rustup component add clippy rust-src
       shell: bash
     - name: Set LIBCLANG_PATH for clang-sys (bindgen/rocksdb etc.)

.github/actions/ubuntu/action.yml

@@ -20,7 +20,7 @@ runs:
         # This installs the channel + every component/target listed in the file.
         rustup toolchain install
         rustup target add wasm32-unknown-unknown
-        rustup component add rustfmt --toolchain nightly
+        rustup toolchain install nightly-2026-08-31 --profile minimal --component rustfmt
         rustup component add clippy rust-src
       shell: bash
     - name: Set LIBCLANG_PATH for clang-sys (bindgen/rocksdb etc.)

.github/workflows/ci.yml

@@ -43,7 +43,7 @@ jobs:
       - name: Run format checks
         run: |
           taplo format --check --config taplo.toml
-          cargo +nightly fmt --all -- --check
+          cargo +nightly-2026-08-31 fmt --all -- --check
 
   build-and-test-matrix:
     name: 🛠️ Build & Test Matrix

.github/workflows/create-release-tag-and-publish.yml

@@ -77,7 +77,7 @@ jobs:
       - name: Run format checks
         run: |
           taplo format --check --config taplo.toml
-          cargo +nightly fmt --all -- --check
+          cargo +nightly-2026-08-31 fmt --all -- --check
 
   build-and-test:
     name: 🛠️ Build & Test Release

src/cli/cold_signing.rs

@@ -606,8 +606,9 @@ mod tests {
 		expected_tail.extend(codec::Encode::encode(&codec::Compact(7u64)));
 		expected_tail.extend(codec::Encode::encode(&codec::Compact(0u128)));
 		expected_tail.push(0u8); // CheckMetadataHash mode = disabled
-						   // Implicit: specVersion, txVersion (LE u32), genesis, era anchor block hash,
-						   // metadataHash Option = None
+
+		// Implicit: specVersion, txVersion (LE u32), genesis, era anchor block hash,
+		// metadataHash Option = None
 		expected_tail.extend(136u32.to_le_bytes());
 		expected_tail.extend(3u32.to_le_bytes());
 		expected_tail.extend([0x49u8; 32]);

src/cli/wormhole.rs

@@ -4348,8 +4348,9 @@ async fn run_check_nullifier(
 	log_print!("  Subsquid URL: {}", subsquid_url);
 	log_print!("");
 
-	// Compute nullifiers for each transfer count
-	let mut nullifiers_to_check: Vec<(String, String, u64)> = Vec::new(); // (nullifier_hex, nullifier_hash, transfer_count)
+	// Compute nullifiers for each transfer count:
+	// (nullifier_hex, nullifier_hash, transfer_count)
+	let mut nullifiers_to_check: Vec<(String, String, u64)> = Vec::new();
 
 	for tc in &transfer_counts {
 		let nullifier = wormhole_lib::compute_nullifier(&secret, *tc).map_err(|e| {