chore(deps): pin dependencies

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
EmbarkStudios/cargo-deny-action	action	pinDigest	→ 3c63498
MarcoIeni/release-plz-action	action	pinDigest	→ 2eb1d8b
Swatinem/rust-cache	action	pinDigest	→ e18b497
actions/cache	action	pinDigest	→ 0057852
actions/checkout	action	pinDigest	→ 11d5960
actions/setup-python	action	pinDigest	→ a26af69
codecov/codecov-action	action	pinDigest	→ b9fd7d1
dtolnay/rust-toolchain	action	pinDigest	→ 4cda84d
dtolnay/rust-toolchain	action	pinDigest	→ 2c7215f
taiki-e/install-action	action	pinDigest	→ 41049aa

---

Configuration

📅 Schedule: (in timezone UTC)

• Branch creation
  • "before 4am on Monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[Copilot]

Pull request overview

Note

Copilot could not run the full agentic suite for this review because it was automatically requested on a bot-authored pull request. Request a review from Copilot under Reviewers to retry with the full agentic suite. Improved support for bot-authored pull requests is coming soon.

This PR hardens GitHub Actions workflows by pinning third-party actions to specific commit SHAs for improved supply-chain security and reproducibility.

Changes:

• Pinned common actions (checkout, rust-toolchain, rust-cache, etc.) to immutable commit SHAs across CI, release, and audit workflows.
• Updated release-plz and other workflow actions to SHA-pinned references.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
.github/workflows/release.yaml	Pins release workflow actions to commit SHAs.
.github/workflows/release-plz.yaml	Pins checkout/rust-toolchain/release-plz actions to commit SHAs.
.github/workflows/ci.yaml	Pins CI actions (checkout/toolchain/cache/codecov/etc.) to commit SHAs.
.github/workflows/audit.yaml	Pins audit workflow actions (checkout/toolchain/cache/cargo-deny) to commit SHAs.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[jimbofreedman]

Pushed ea90f8f to unblock this — all 19 checks now pass (was 6 test rows + coverage failing).

Why it was red

renovate.json has extended helpers:pinGitHubActionDigests since the repo skeleton (ENG-4676), so this PR is the policy working as configured. But three assertions written later (ENG-4686, ENG-4692) matched the bare tag with a file-wide contains:

Assertion	Status before
EmbarkStudios/cargo-deny-action@v2	❌ failing
MarcoIeni/release-plz-action@v0.5	❌ failing (masked — cargo test bailed after the first binary)
rustsec/audit-check@v2	⚠️ latent — passes only because Renovate has not resolved a digest for it yet

So the repo’s own supply-chain policy failed its own tests the moment Renovate acted on it. The tests were the defect, not the pins.

Fix

A pins_action_at helper replaces the three contains checks. It accepts either form — floating tag @v2 or digest annotated with it, @<sha> # v2 — and still rejects what the originals existed to catch: a branch ref (@main), an unannotated digest, and a digest whose comment names a different version. Matching is now per-line and exact, so v0.5 is no longer satisfied by a v0.51 tag. Fixes both live failures and the latent third.

No workflow, config, or library code touched — assertions only.

Verification

Local, on ea90f8f:

cargo fmt --all --check                              ✔
cargo clippy --all-targets --all-features -D warnings ✔
cargo test --all-features --no-fail-fast              ✔  141 passed, 2 ignored, 25 suites
pre-commit run --files <changed>                      ✔  15 hooks

CI: 19/19 green, mergeable: MERGEABLE, 0 unresolved threads.

Two notes for whoever merges

• Both Copilot comments were declined with reasoning, not silently resolved. Verified against the GitHub API: v0.5 is an annotated tag dereferencing to exactly the pinned SHA, and v0.5.0 is a different commit — so # v0.5.0 would have been wrong. dtolnay/rust-toolchain publishes versions as branches (1 tag in the entire repo), so there is no release tag to substitute for # master.
• Renovate will now treat this branch as modified and stop rebasing or updating it, since it carries a non-Renovate commit. Worth a glance at the Dependency Dashboard if this sits unmerged.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated no new comments.

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.