ci: use oidc in crates.io, use committed, cargo-deny, zizmor

[MuntasirSZN]

Related Issue(s)

Description

• THIS NEEDS trusted publishing set up in crates.io dashboard.

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

[Copilot]

Pull request overview

This PR modernizes the CI/CD infrastructure by migrating to Rust-native tooling, implementing OIDC-based authentication for crates.io, and enhancing security through GitHub Actions best practices. The changes remove Node.js-based commitlint in favor of the Rust-based committed tool, add cargo-deny and zizmor for dependency and workflow security analysis, and standardize on SHA-pinned GitHub Actions with credential protection.

Key Changes:

• Migrated from @commitlint (Node.js) to committed (Rust) for commit linting
• Implemented OIDC trusted publishing for crates.io releases instead of API tokens
• Added cargo-deny for dependency security/license checking and zizmor for workflow security analysis
• Standardized all GitHub Actions to use commit SHA pinning with persist-credentials: false

Reviewed changes

Copilot reviewed 21 out of 22 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
.github/workflows/release.yml	Adds OIDC authentication for crates.io publishing, pins actions to commit SHAs, adds persist-credentials: false, and refines permissions
.github/workflows/checks.yml	Replaces dtolnay/rust-toolchain with moonrepo/setup-rust, adds cargo-deny job, pins actions to SHAs, adds top-level permissions
.github/workflows/committed.yml	New workflow for commit message linting using the Rust-based committed tool
.github/workflows/zizmor.yml	New workflow for GitHub Actions security analysis
.github/workflows/build.yaml	Critical issue: Changes environment variable syntax from ${{ env.var }} to ${VAR} which will break the workflow
.github/workflows/commitlint.yml	Removed - replaced by committed.yml
.github/workflows/security.yml	Pins actions to commit SHAs, adds persist-credentials: false, adds top-level permissions
.github/workflows/spelling.yml	Pins actions to commit SHAs, adds persist-credentials: false
.github/workflows/stale.yml	Pins actions to commit SHAs
.github/workflows/validate-pr-title.yml	Pins actions to commit SHAs, changes trigger from pull_request_target to pull_request
.github/workflows/neovim-checks.yml	Pins actions to commit SHAs, adds persist-credentials: false, adds top-level permissions
.github/workflows/docker-checks.yml	Pins actions to commit SHAs, adds persist-credentials: false, adds top-level permissions
.github/workflows/changelog.yml	Pins actions to commit SHAs, adds persist-credentials: false
.github/dependabot.yml	Removes scripts/npm ecosystem (no longer needed), adds cooldown configuration, reorders entries
.github/actions/get-rust-channel/action.yml	New composite action to read Rust channel from scripts/build/channel file
.github/zizmor.yml	Configuration for zizmor security analysis tool with ignores for release.yml
deny.toml	New cargo-deny configuration for dependency checking (advisories, licenses, bans, sources)
committed.toml	New committed configuration for conventional commit style with bot ignores
scripts/package.json	Removed - commitlint dependencies no longer needed
scripts/pnpm-lock.yaml	Removed - commitlint lock file no longer needed
scripts/.commitlintrc.json	Removed - replaced by committed.toml
.github/ISSUE_TEMPLATE/*.yml	Minor whitespace cleanup

Files not reviewed (1)

• scripts/pnpm-lock.yaml: Language not supported

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[MuntasirSZN]

Just ignore zizmor lol

[MuntasirSZN]

Ready

[MuntasirSZN]

Now in bulk pr.