Cargo Workflows

Run every cargo command from the directory that holds the workspace Cargo.toml. Cargo reads .cargo/config.toml from the current directory upward, so a command run inside a member can build with different settings.

Cargo.lock and --locked

Commit Cargo.lock for every package, libraries included. cargo new tracks it by default, and every --locked command needs it. Pass --locked on every cargo command that CI, a host build system, or an agent runs. Without it, a build silently resolves new versions and stops being reproducible. Omit it only in a command whose purpose is to change the lock: cargo update, cargo add, the cargo metadata resolve in the triage table below, and the scheduled latest-dependencies job.

Change the lockfile only on purpose, in a change that says why: