[build] pin whisper-rs dependency to a specific commit for reproducible builds; update documentation accordingly

Cargo.lock

@@ -1959,7 +1959,7 @@ dependencies = [
 [[package]]
 name = "whisper-rs"
 version = "0.14.3"
-source = "git+https://github.com/tazz4843/whisper-rs#135b60b85a15714862806b6ea9f76abec38156f1"
+source = "git+https://github.com/tazz4843/whisper-rs?rev=135b60b85a15714862806b6ea9f76abec38156f1#135b60b85a15714862806b6ea9f76abec38156f1"
 dependencies = [
  "whisper-rs-sys",
 ]
@@ -1967,7 +1967,7 @@ dependencies = [
 [[package]]
 name = "whisper-rs-sys"
 version = "0.13.0"
-source = "git+https://github.com/tazz4843/whisper-rs#135b60b85a15714862806b6ea9f76abec38156f1"
+source = "git+https://github.com/tazz4843/whisper-rs?rev=135b60b85a15714862806b6ea9f76abec38156f1#135b60b85a15714862806b6ea9f76abec38156f1"
 dependencies = [
  "bindgen",
  "cfg-if",

Cargo.toml

@@ -29,7 +29,9 @@ chrono = { version = "0.4", features = ["clock"] }
 reqwest = { version = "0.12", features = ["blocking", "json"] }
 sha2 = "0.10"
 # Make whisper-rs optional; enabled via `whisper` feature
-whisper-rs = { git = "https://github.com/tazz4843/whisper-rs", default-features = false, optional = true }
+# Pin whisper-rs to a known-good commit for reproducible builds.
+# To update: run `cargo update -p whisper-rs --precise 135b60b85a15714862806b6ea9f76abec38156f1` (adjust SHA) and update this rev.
+whisper-rs = { git = "https://github.com/tazz4843/whisper-rs", rev = "135b60b85a15714862806b6ea9f76abec38156f1", default-features = false, optional = true }
 libc = "0.2"
 indicatif = "0.17"
 ctrlc = "3.4"

docs/ci.md

@@ -14,6 +14,10 @@ Example GitHub Actions job (outline)
   steps:
   - uses: actions/checkout@v4
   - uses: dtolnay/rust-toolchain@stable
+  - name: Print resolved whisper-rs rev
+    run: |
+      echo "Resolved whisper-rs revision:" && \
+      awk '/name = "whisper-rs"/{f=1} f&&/source = "git\+.*whisper-rs#/{match($0,/#([0-9a-f]{7,40})"/,m); if(m[1]){print m[1]; exit}}' Cargo.lock
   - name: Build
     run: cargo build --all-targets --locked
   - name: Test

docs/development.md

@@ -13,6 +13,12 @@ Rust toolchain
   - rustup install stable
   - rustup default stable
 
+Dependency pinning
+- We pin whisper-rs (git dependency) to a known-good commit in Cargo.toml for reproducibility.
+- To bump it, resolve/test the desired commit locally, then run:
+  - cargo update -p whisper-rs --precise 135b60b85a15714862806b6ea9f76abec38156f1
+  Replace the SHA with the desired commit and update the rev in Cargo.toml accordingly.
+
 Build
 - CPU-only (default):
   - cargo build