From e90c444476609485ea3f5ff67ab12f65d75b11df Mon Sep 17 00:00:00 2001 From: "Dylan M. Taylor" Date: Wed, 11 Nov 2026 14:57:30 -0500 Subject: [PATCH] ci: use StepSecurity's maintained actions (#23) Each third-party action that StepSecurity publishes a secure drop-in replacement for now uses that replacement, pinned to a commit with its version as a comment. Versions follow what we used: the newest StepSecurity release in the same major, or the closest major they publish. dtolnay/rust-toolchain refs that named a toolchain (stable, nightly, 1.76) become the replacement's `toolchain` input. --- .github/workflows/gdi.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/gdi.yml b/.github/workflows/gdi.yml index ccebc4f..b322ffc 100644 --- a/.github/workflows/gdi.yml +++ b/.github/workflows/gdi.yml @@ -27,8 +27,9 @@ jobs: with: egress-policy: audit - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: dtolnay/rust-toolchain@stable + - uses: step-security/dtolnay-rust-toolchain@8dd607977d06adf4ed49b190381e74c17a9dd25f # v1.0.0 with: + toolchain: stable components: rustfmt, clippy targets: wasm32-unknown-unknown - run: cargo fmt --manifest-path crates/gdi/Cargo.toml --check