From ce15e30f7504b2d8332fac92b7d5ac216c0c2ea4 Mon Sep 17 00:00:00 2001
From: satyakwok <119509589+satyakwok@users.noreply.github.com>
Date: Mon, 8 Jun 2026 09:52:05 +0200
Subject: [PATCH 1/2] ci: install cargo-deny via install-action instead of
 cargo-deny-action
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The cargo-deny-action rebuilds a Docker image each run (apk add + curl the musl binary), which flaked twice on transient apk-mirror / GitHub-release hiccups and red-X'd otherwise-clean runs. taiki-e/install-action pulls a cached prebuilt binary (already used for nextest here, same pinned SHA) — faster and no per-run Docker build. Adds the rust-toolchain step so cargo metadata resolves the pinned 1.95.0 toolchain (also removes the old musl-toolchain warning noise).
---
 .github/workflows/ci.yml | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 55c3e26..df6533b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -49,7 +49,16 @@ jobs:
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-      - uses: EmbarkStudios/cargo-deny-action@bb137d7af7e4fb67e5f82a49c4fce4fad40782fe # v2
+
+      # Install cargo-deny from a cached prebuilt binary instead of the
+      # cargo-deny-action's per-run Docker build (apk + curl download of the
+      # musl binary), which flaked twice on transient apk/GH-release hiccups.
+      - name: Install Rust toolchain (from rust-toolchain.toml)
+        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
+
+      - name: Install cargo-deny
+        uses: taiki-e/install-action@da71d5095c1b175e60393b8d36727208ae905210 # cargo-deny
         with:
-          command: check
-          arguments: --all-features
+          tool: cargo-deny
+
+      - run: cargo deny check --all-features

From fbd0df7109c67db0a42957884571c57484f39fa9 Mon Sep 17 00:00:00 2001
From: satyakwok <119509589+satyakwok@users.noreply.github.com>
Date: Mon, 8 Jun 2026 09:56:57 +0200
Subject: [PATCH 2/2] ci: pass --all-features before the cargo-deny subcommand

Newer cargo-deny (from install-action) treats --all-features as a global cargo-metadata flag, so it must precede 'check' (cargo deny --all-features check), not follow it.
---
 .github/workflows/ci.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index df6533b..2c7d635 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -61,4 +61,5 @@ jobs:
         with:
           tool: cargo-deny
 
-      - run: cargo deny check --all-features
+      # `--all-features` is a global (cargo-metadata) flag → must precede the subcommand.
+      - run: cargo deny --all-features check