ci: keep Cargo.lock in step with releases and gate CI on --locked

.github/workflows/ci.yml

@@ -47,7 +47,7 @@ jobs:
         with:
           toolchain: stable
       - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
-      - run: cargo check
+      - run: cargo check --locked
 
   check-wasm:
     name: Cargo Check (WASM)

CONTRIBUTING.md

@@ -24,6 +24,8 @@ cargo test
 make test-integration
 ```
 
+`Cargo.lock` is committed and CI runs `cargo check --locked`, so commit lockfile changes alongside any dependency change. The release PR bumps the workspace members' entries in `Cargo.lock` itself (see `release-please-config.json`), so a release never leaves the lockfile stale.
+
 ## Release Process
 
 ### Publishable Crates

release-please-config.json

@@ -44,6 +44,11 @@
           "type": "toml",
           "path": "Cargo.toml",
           "jsonpath": "$.workspace.dependencies.multistore-path-mapping.version"
+        },
+        {
+          "type": "toml",
+          "path": "Cargo.lock",
+          "jsonpath": "$.package[?(!@.source)].version"
         }
       ]
     }