ci: pin nightly jobs to nightly-2026-10-30

.github/workflows/ci.yml

@@ -642,6 +642,11 @@ jobs:
 
       - name: Install Rust nightly
         uses: dtolnay/rust-toolchain@5b842231ba77f5c045dba54ac5560fed2db780e2 # nightly
+        with:
+          # Pinned: nightly 2026-10-31 (rustc f9ceb4a4d) fails to compile bashkit
+          # (E0391 async-drop cycle on parser::ast::CommandList). Unpin once a
+          # later nightly builds `cargo +nightly check -p bashkit --lib`.
+          toolchain: nightly-2026-10-30
 
       - name: Install cargo-fuzz
         uses: taiki-e/cache-cargo-install-action@9ee83daaa7b96a6fab930949ecf1122bba04a389 # v3
@@ -652,9 +657,9 @@ jobs:
       - name: Verify fuzz targets compile
         working-directory: crates/bashkit
         run: |
-          cargo +nightly fuzz build
-          cargo +nightly fuzz build --features cpython cpython_fuzz
-          cargo +nightly fuzz build --features cpython cpython_http_fuzz
+          cargo +nightly-2026-10-30 fuzz build
+          cargo +nightly-2026-10-30 fuzz build --features cpython cpython_fuzz
+          cargo +nightly-2026-10-30 fuzz build --features cpython cpython_http_fuzz
 
   # Gate job for branch protection — name must stay "Check"
   check:

.github/workflows/fuzz.yml

@@ -35,6 +35,11 @@ jobs:
 
       - name: Install Rust nightly
         uses: dtolnay/rust-toolchain@5b842231ba77f5c045dba54ac5560fed2db780e2 # nightly
+        with:
+          # Pinned: nightly 2026-10-31 (rustc f9ceb4a4d) fails to compile bashkit
+          # (E0391 async-drop cycle on parser::ast::CommandList). Unpin once a
+          # later nightly builds `cargo +nightly check -p bashkit --lib`.
+          toolchain: nightly-2026-10-30
 
       - name: Install cargo-fuzz
         run: cargo install cargo-fuzz --locked
@@ -62,7 +67,7 @@ jobs:
           fi
           features=()
           case "${{ matrix.target }}" in cpython_*) features=(--features cpython) ;; esac
-          cargo +nightly fuzz run "${features[@]}" ${{ matrix.target }} -- \
+          cargo +nightly-2026-10-30 fuzz run "${features[@]}" ${{ matrix.target }} -- \
             -max_total_time="$DURATION_INPUT" \
             -print_final_stats=1
 

.github/workflows/nightly.yml

@@ -28,14 +28,18 @@ jobs:
       - name: Install Rust nightly with Miri
         uses: dtolnay/rust-toolchain@5b842231ba77f5c045dba54ac5560fed2db780e2 # nightly
         with:
+          # Pinned: nightly 2026-10-31 (rustc f9ceb4a4d) fails to compile bashkit
+          # (E0391 async-drop cycle on parser::ast::CommandList). Unpin once a
+          # later nightly builds `cargo +nightly check -p bashkit --lib`.
+          toolchain: nightly-2026-10-30
           components: miri
 
       - name: Setup Miri
-        run: cargo +nightly miri setup
+        run: cargo +nightly-2026-10-30 miri setup
 
       - name: Run Miri on library tests
         run: |
-          cargo +nightly miri test --lib -p bashkit -- \
+          cargo +nightly-2026-10-30 miri test --lib -p bashkit -- \
             --test-threads=1 \
             test_parse_simple_command \
             test_parse_variable \
@@ -146,6 +150,10 @@ jobs:
       - name: Install Rust nightly
         uses: dtolnay/rust-toolchain@5b842231ba77f5c045dba54ac5560fed2db780e2 # nightly
         with:
+          # Pinned: nightly 2026-10-31 (rustc f9ceb4a4d) fails to compile bashkit
+          # (E0391 async-drop cycle on parser::ast::CommandList). Unpin once a
+          # later nightly builds `cargo +nightly check -p bashkit --lib`.
+          toolchain: nightly-2026-10-30
           components: rust-src
 
       - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2
@@ -165,5 +173,5 @@ jobs:
           RUSTFLAGS: "-Z sanitizer=address"
           ASAN_OPTIONS: "detect_stack_use_after_return=1:detect_leaks=0"
         run: |
-          cargo +nightly test -Z build-std --target x86_64-unknown-linux-gnu --lib --tests \
+          cargo +nightly-2026-10-30 test -Z build-std --target x86_64-unknown-linux-gnu --lib --tests \
             -- --test-threads=1

knowledge/log.md

@@ -1,5 +1,9 @@
 # Bashkit Knowledge Update Log
 
+## 2026-11-01
+
+* **CI nightly pin**: Every nightly job (fuzz compile check, scheduled fuzz, Miri, ASan build-std) is pinned to `nightly-2026-10-30`. Nightly 2026-10-31 (rustc f9ceb4a4d) rejects the `bashkit` lib with E0391, an async-drop query cycle on `parser::ast::CommandList`; reproduced on unmodified `main`, and the 2026-10-30 nightly builds it. Unpin when a later nightly passes `cargo +nightly check -p bashkit --lib`.
+
 ## 2026-10-30
 
 * **Windows signing preparation**: Separate unsigned Windows build outputs from publishable wheels. Add a credential-isolated Azure OIDC signing job, native signature/timestamp checks, RECORD regeneration, and a Windows packaging test job. Rollout requires verified publisher identity, a Public Trust profile, profile-scoped signer permission, and a GitHub environment restricted to release tags; the signing gate must remain unmerged until those prerequisites are ready. See [Python Package](runtimes/python-package.md#authenticode-release-path).