ci: use oidc in crates.io, use committed, cargo-deny, zizmor

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -10,7 +10,6 @@ body:
         Before submitting, please search existing issues to avoid duplicates. If a similar issue exists, comment there instead of opening a new one.
 
         To help us resolve the issue efficiently, please provide the necessary details below.
-
   - type: textarea
     id: bug-description
     attributes:
@@ -19,7 +18,6 @@ body:
       placeholder: Provide a clear and concise description of the problem, including what you expected to happen and what actually occurred.
     validations:
       required: true
-
   - type: textarea
     id: environment
     attributes:

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -9,15 +9,13 @@ body:
         A clear and concise description of what the problem is.
     validations:
       required: true
-
   - type: textarea
     attributes:
       label: Describe the solution you'd like
       description: |
         A clear and concise description of what you'd like to happen.
     validations:
       required: true
-
   - type: textarea
     attributes:
       label: Additional context

.github/dependabot.yml

@@ -10,24 +10,22 @@ updates:
         update-types:
           - patch
           - minor
+    cooldown:
+      default-days: 7
   - package-ecosystem: github-actions
     directory: "/"
     schedule:
       interval: weekly
-  - package-ecosystem: npm
-    directory: "/vscode"
-    schedule:
-      interval: weekly
     groups:
       version:
         applies-to: version-updates
         update-types:
           - patch
           - minor
-    ignore:
-      - dependency-name: "@types/vscode"
-  - package-ecosystem: docker
-    directory: "/"
+    cooldown:
+      default-days: 7
+  - package-ecosystem: npm
+    directory: "/vscode"
     schedule:
       interval: weekly
     groups:
@@ -36,8 +34,10 @@ updates:
         update-types:
           - patch
           - minor
-  - package-ecosystem: npm
-    directory: "/scripts"
+    cooldown:
+      default-days: 7
+  - package-ecosystem: docker
+    directory: "/"
     schedule:
       interval: weekly
     groups:
@@ -46,4 +46,5 @@ updates:
         update-types:
           - patch
           - minor
-          - major
+    cooldown:
+      default-days: 7

.github/workflows/build.yaml

@@ -1,5 +1,4 @@
 name: Build RustOwl
-
 on:
   push:
     branches: ["main"]
@@ -11,7 +10,6 @@ on:
       run_id:
         description: Run ID of this workflow
         value: ${{ github.run_id }}
-
 jobs:
   rustowl:
     if: github.event.action != 'labeled' || github.event.label.name == 'do-build-check'
@@ -21,21 +19,20 @@ jobs:
           - ubuntu-24.04
           - ubuntu-24.04-arm
           - macos-15
-          - macos-13
+          - macos-15-intel
           - windows-2022
           - windows-11-arm
-
     runs-on: ${{ matrix.os }}
     permissions:
       contents: write
     defaults:
       run:
         shell: bash
-
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
-
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          persist-credentials: false
       # Using fat LTO causes failure to link on Windows ARM
       - name: Set build profile
         run: |
@@ -44,12 +41,10 @@ jobs:
           else
             echo "build_profile=release" >> $GITHUB_ENV
           fi
-
       # uname on Windows on ARM returns "x86_64"
       - name: Set ARCH flag for Windows on ARM
         if: matrix.os == 'windows-11-arm'
         run: echo "TOOLCHAIN_ARCH=aarch64" >> $GITHUB_ENV
-
       - name: setup env
         run: |
           host_tuple="$(./scripts/build/toolchain eval 'echo $HOST_TUPLE')"
@@ -60,13 +55,11 @@ jobs:
           ([[ "$host_tuple" == *msvc* ]] && echo "exec_ext=.exe" || echo "exec_ext=") >> $GITHUB_ENV
           ([[ "$host_tuple" == *windows* ]] && echo "is_windows=true" || echo "is_windows=false") >> $GITHUB_ENV
           ([[ "$host_tuple" == *linux* ]] && echo "is_linux=true" || echo "is_linux=false") >> $GITHUB_ENV
-
       - name: Install zig
         if: ${{ env.is_linux == 'true' }}
-        uses: mlugg/setup-zig@v2
+        uses: mlugg/setup-zig@fa65c4058643678a4e4a9a60513944a7d8d35440 # v2.1.0
         with:
           version: 0.13.0
-
       - name: Build
         run: |
           if [[ "${{ env.is_linux }}" == "true" ]]; then
@@ -75,19 +68,16 @@ jobs:
           else
             ./scripts/build/toolchain cargo build --target ${{ env.host_tuple }} --profile=${{ env.build_profile }}
           fi
-
       - name: Check the functionality
         run: |
           ./target/${{ env.host_tuple }}/${{ env.build_profile }}/rustowl${{ env.exec_ext }} check ./perf-tests/dummy-package
-
       - name: Set archive name
         run: |
           if [[ "${{ env.is_windows }}" == "true" ]]; then
             echo "archive_name=rustowl-${{ env.host_tuple }}.zip" >> $GITHUB_ENV
           else
             echo "archive_name=rustowl-${{ env.host_tuple }}.tar.gz" >> $GITHUB_ENV
           fi
-
       - name: Setup archive artifacts
         run: |
           rm -rf rustowl && mkdir -p rustowl/sysroot/${{ env.toolchain }}/bin
@@ -113,43 +103,38 @@ jobs:
           fi
 
           cp ./rustowl/rustowl${{ env.exec_ext }} ./rustowl-${{ env.host_tuple }}${{ env.exec_ext }}
-
       - name: Upload
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: rustowl-runtime-${{ env.host_tuple }}
           path: |
             rustowl-${{ env.host_tuple }}${{ env.exec_ext }}
             ${{ env.archive_name }}
-
   vscode:
     if: github.event.action != 'labeled' || github.event.label.name == 'do-build-check'
     runs-on: ubuntu-latest
     permissions:
       contents: write
-
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
-
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          persist-credentials: false
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
         with:
           node-version: 20
-
       - name: Setup PNPM And Install dependencies
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
         with:
           package_json_file: ./vscode/package.json
           run_install: |
             - cwd: ./vscode
-
       - name: Create VSIX
         run: pnpm build
         working-directory: ./vscode
-
       - name: Upload
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: rustowl-vscode
           path: vscode/**/*.vsix

.github/workflows/changelog.yml

@@ -1,25 +1,22 @@
 name: Generate Changelog
-
 on:
   workflow_dispatch:
-
 jobs:
   changelogen:
     runs-on: ubuntu-latest
     permissions:
       contents: write
       pull-requests: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           fetch-depth: 0
-
+          persist-credentials: false
       - run: |
           docker pull quay.io/git-chglog/git-chglog:latest
           docker run -v "$PWD":/workdir quay.io/git-chglog/git-chglog --tag-filter-pattern '^v\d+\.\d+\.\d+$' -o CHANGELOG.md
-
       - name: Create Pull Request
-        uses: peter-evans/create-pull-request@v7
+        uses: peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676 # v7.0.11
         with:
           add-paths: |
             CHANGELOG.md

.github/workflows/checks.yml

@@ -1,23 +1,23 @@
 name: Basic Checks
-
 on:
   pull_request:
     branches: ["main"]
   workflow_dispatch:
   workflow_call:
-
+permissions:
+  contents: read
 env:
   CARGO_TERM_COLOR: always
   RUSTC_BOOTSTRAP: 1
-
 jobs:
   check:
     name: Format & Lint
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
-
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          persist-credentials: false
       - name: Get Rust version
         run: |
           echo RUSTUP_TOOLCHAIN=$(cat ./scripts/build/channel) >> $GITHUB_ENV
@@ -32,59 +32,57 @@ jobs:
         uses: Swatinem/rust-cache@v2
         with:
           save-if: ${{ github.ref == 'refs/heads/main' }}
-
       - name: Check formatting
         run: cargo fmt --check
-
       - name: Run clippy
         run: cargo clippy --all-targets --all-features -- -D warnings
-
   test:
     name: Build & Test
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
-
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          persist-credentials: false
       - name: Cache dependencies
-        uses: Swatinem/rust-cache@v2
-
+        uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2
       - name: Build release
         run: ./scripts/build/toolchain cargo build --release
-
       - name: Install binary
         run: ./scripts/build/toolchain cargo install --path .
-
       - name: Test rustowl check
         run: rustowl check ./perf-tests/dummy-package
-
   vscode:
     name: VS Code Extension Checks
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
-
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          persist-credentials: false
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
         with:
           node-version: 20
-
       - name: Setup PNPM And Install dependencies
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
         with:
           package_json_file: ./vscode/package.json
           run_install: |
             - cwd: ./vscode
-
       - name: Check formatting
         run: pnpm prettier -c src
         working-directory: ./vscode
-
       - name: Lint and type check
         run: pnpm lint && pnpm check-types
         working-directory: ./vscode
-
       - name: Run tests
         run: xvfb-run -a pnpm run test
         working-directory: ./vscode
+  cargo-deny:
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          persist-credentials: false
+      - uses: EmbarkStudios/cargo-deny-action@76cd80eb775d7bbbd2d80292136d74d39e1b4918 # v2.0.14