From b8bb06581d0ea9ab701e6ae86b04659edca19fbe Mon Sep 17 00:00:00 2001
From: Oliver Hamlet <git@ortham.net>
Date: Wed, 1 Oct 2025 20:06:08 +0100
Subject: [PATCH] Install cargo-vet using a Git commit hash

The hash doubles as a checksum of the code that's downloaded and built. Installing from crates.io doesn't provide equivalent functionality.
---
 .github/workflows/ci.yml | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 007d18d..f5bc1d7 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -30,7 +30,7 @@ jobs:
     runs-on: ubuntu-24.04
 
     env:
-      CARGO_VET_VERSION: 0.10.1
+      CARGO_VET_REV: c178261c96c9f820f67817e9c5458db655ddc21f # 0.10.1
 
     steps:
     - uses: actions/checkout@v4
@@ -38,16 +38,19 @@ jobs:
     - uses: actions/cache@v4
       with:
         path: ${{ runner.tool_cache }}/cargo-vet
-        key: cargo-vet-bin-${{ env.CARGO_VET_VERSION }}
+        key: cargo-vet-bin-${{ env.CARGO_VET_REV }}
 
     - name: Add the tool cache directory to the search path
       run: echo "${{ runner.tool_cache }}/cargo-vet/bin" >> $GITHUB_PATH
 
     - name: Ensure that the tool cache is populated with the cargo-vet binary
-      run: cargo install --root ${{ runner.tool_cache }}/cargo-vet --version ${{ env.CARGO_VET_VERSION }} --locked cargo-vet
+      run: cargo install --root ${{ runner.tool_cache }}/cargo-vet --locked --git https://github.com/mozilla/cargo-vet --rev ${{ env.CARGO_VET_REV }} cargo-vet
+      if: steps.cache-cargo-vet.outputs.cache-hit != 'true'
 
     - name: Invoke cargo-vet
-      run: cargo vet --locked
+      run: |
+        cargo vet --version
+        cargo vet --locked
 
   build:
     strategy: