Merge main to pick up the 1.97.1 toolchain and the reworked CI

No conflicts. This branch had drifted nine commits behind and still pinned Rust
1.92.0, while `main` moved to 1.97.1 in rubyatscale#52 and reworked all four workflow files
in rubyatscale#51, rubyatscale#55 and rubyatscale#57. So a CI run on the old tip would have tested this against a
toolchain and a workflow set that no longer exist, which is worth avoiding given
no run has ever been approved here.

`recorded_key()` and the two comparison sites are untouched by the merge. The
only changes reaching this branch's own code are main's clippy fixes in the
`build_stale_violations` error paths, which arrived cleanly.

Verified on the merged tree with the 1.97.1 toolchain the merge brings in:
`cargo test --no-fail-fast` 258 passed 0 failed, `cargo clippy --all-targets
--all-features -- -Dwarnings` clean, `cargo fmt --check` clean.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: iMacTia

.github/workflows/audit.yml

@@ -9,11 +9,24 @@ on:
       - '**/Cargo.lock'
   pull_request:
 
+permissions: {}
+
 jobs:
   audit:
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
-      - uses: actions-rs/audit-check@v1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      # Installs a prebuilt cargo-audit from the upstream GitHub releases and
+      # verifies its SHA256 checksum. `actions-rs/audit-check` built it with
+      # `cargo install`, which broke once cargo-audit's dependencies outran the
+      # runner's toolchain. `fallback: none` keeps that compile path from
+      # silently coming back if the download ever fails.
+      - uses: taiki-e/install-action@5b4d68e2e660441203ab128a23676f1e4faf1532 # v2.86.3
         with:
-          token: ${{ secrets.GITHUB_TOKEN }}
+          tool: cargo-audit
+          fallback: none
+      - run: cargo audit

.github/workflows/ci.yml

@@ -17,13 +17,18 @@ on:
 env:
   CARGO_TERM_COLOR: always
 
+permissions:
+  contents: read
+
 jobs:
   check:
     name: Check
     runs-on: ubuntu-latest
     steps:
       - name: Checkout sources
-        uses: actions/checkout@v2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Run cargo check
         run: cargo check
@@ -32,7 +37,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout sources
-        uses: actions/checkout@v2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Run cargo test with backtrace
         run: cargo test -- --nocapture
@@ -45,7 +52,9 @@ jobs:
       RUSTFLAGS: '-Dwarnings'
     steps:
       - name: Checkout sources
-        uses: actions/checkout@v2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Run cargo fmt
         run: cargo fmt --all -- --check

.github/workflows/release.yml

@@ -56,7 +56,7 @@ jobs:
     env:
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
         with:
           persist-credentials: false
           submodules: recursive
@@ -66,7 +66,7 @@ jobs:
         shell: bash
         run: "curl --proto '=https' --tlsv1.2 -LsSf https://github.com/axodotdev/cargo-dist/releases/download/v0.30.3/cargo-dist-installer.sh | sh"
       - name: Cache dist
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
         with:
           name: cargo-dist-cache
           path: ~/.cargo/bin/dist
@@ -82,7 +82,7 @@ jobs:
           cat plan-dist-manifest.json
           echo "manifest=$(jq -c "." plan-dist-manifest.json)" >> "$GITHUB_OUTPUT"
       - name: "Upload dist-manifest.json"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
         with:
           name: artifacts-plan-dist-manifest
           path: plan-dist-manifest.json
@@ -120,7 +120,7 @@ jobs:
       - name: enable windows longpaths
         run: |
           git config --global core.longpaths true
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
         with:
           persist-credentials: false
           submodules: recursive
@@ -135,7 +135,7 @@ jobs:
         run: ${{ matrix.install_dist.run }}
       # Get the dist-manifest
       - name: Fetch local artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
         with:
           pattern: artifacts-*
           path: target/distrib/
@@ -149,7 +149,7 @@ jobs:
           dist build ${{ needs.plan.outputs.tag-flag }} --print=linkage --output-format=json ${{ matrix.dist_args }} > dist-manifest.json
           echo "dist ran successfully"
       - name: Attest
-        uses: actions/attest-build-provenance@v2
+        uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be
         with:
           subject-path: "target/distrib/*${{ join(matrix.targets, ', ') }}*"
       - id: cargo-dist
@@ -166,7 +166,7 @@ jobs:
 
           cp dist-manifest.json "$BUILD_MANIFEST_NAME"
       - name: "Upload artifacts"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
         with:
           name: artifacts-build-local-${{ join(matrix.targets, '_') }}
           path: |
@@ -183,19 +183,19 @@ jobs:
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       BUILD_MANIFEST_NAME: target/distrib/global-dist-manifest.json
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
         with:
           persist-credentials: false
           submodules: recursive
       - name: Install cached dist
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
         with:
           name: cargo-dist-cache
           path: ~/.cargo/bin/
       - run: chmod +x ~/.cargo/bin/dist
       # Get all the local artifacts for the global tasks to use (for e.g. checksums)
       - name: Fetch local artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
         with:
           pattern: artifacts-*
           path: target/distrib/
@@ -213,7 +213,7 @@ jobs:
 
           cp dist-manifest.json "$BUILD_MANIFEST_NAME"
       - name: "Upload artifacts"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
         with:
           name: artifacts-build-global
           path: |
@@ -233,19 +233,19 @@ jobs:
     outputs:
       val: ${{ steps.host.outputs.manifest }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
         with:
           persist-credentials: false
           submodules: recursive
       - name: Install cached dist
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
         with:
           name: cargo-dist-cache
           path: ~/.cargo/bin/
       - run: chmod +x ~/.cargo/bin/dist
       # Fetch artifacts from scratch-storage
       - name: Fetch artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
         with:
           pattern: artifacts-*
           path: target/distrib/
@@ -258,14 +258,14 @@ jobs:
           cat dist-manifest.json
           echo "manifest=$(jq -c "." dist-manifest.json)" >> "$GITHUB_OUTPUT"
       - name: "Upload dist-manifest.json"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
         with:
           # Overwrite the previous copy
           name: artifacts-dist-manifest
           path: dist-manifest.json
       # Create a GitHub Release while uploading all files to it
       - name: "Download GitHub Artifacts"
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
         with:
           pattern: artifacts-*
           path: artifacts
@@ -298,7 +298,7 @@ jobs:
     env:
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
         with:
           persist-credentials: false
           submodules: recursive

.github/workflows/zizmor.yml

@@ -0,0 +1,23 @@
+name: GitHub Actions Security Analysis
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: ["**"]
+
+permissions: {}
+
+jobs:
+  zizmor:
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      contents: read
+      actions: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@6fc4b006235f201fdab3722e17240ab420d580e5 # v0.6.1

.github/zizmor.yml

@@ -0,0 +1,33 @@
+# Configuration for the zizmor GitHub Actions security linter.
+# See https://docs.zizmor.sh/configuration/
+#
+# Everything ignored below is in release.yml, which is autogenerated by dist
+# (cargo-dist) from dist-workspace.toml -- see the header comment in that file.
+# Editing release.yml by hand does not work: the next `dist generate` overwrites
+# it. Where dist offers a knob we use it (the actions in release.yml are pinned
+# to commits via [dist.github-action-commits] in dist-workspace.toml), and what
+# is left below is inherent to dist's template and has no such knob.
+#
+# These are deliberately file-scoped rather than line-scoped, because line
+# numbers shift whenever release.yml is regenerated.
+rules:
+  excessive-permissions:
+    ignore:
+      # dist declares `contents: write` at the workflow level because the
+      # announce job creates the GitHub Release. Narrowing it per-job is
+      # dist's call, not ours.
+      - release.yml
+  template-injection:
+    ignore:
+      # dist interpolates `github.ref_name`, `needs.plan.outputs.tag*` and its
+      # `matrix.*` build parameters straight into run blocks. The tag-derived
+      # values only expand on `push:` of a tag, which requires push access, and
+      # expand to '' on pull_request. The matrix values come from dist's own
+      # plan output, not from user input.
+      - release.yml
+  unpinned-images:
+    ignore:
+      # `container: ${{ matrix.container && matrix.container.image || null }}`.
+      # This repo configures no custom container runners, so matrix.container is
+      # always null and no image is ever pulled.
+      - release.yml

CHANGELOG.md

@@ -23,3 +23,17 @@ excluded, and the old behavior (analyze everything) was rarely desired.
 ```yaml
 respect_gitignore: false
 ```
+
+### Internal
+
+#### Replaced `serde_yaml` with `yaml_serde`
+
+`serde_yaml` was discontinued in March 2024, and its `unsafe-libyaml` backend has
+been unreleased since. pks now depends on
+[`yaml_serde`](https://github.com/yaml/yaml-serde), the YAML organization's
+maintained fork, which is backed by `libyaml-rs` from the same org.
+
+`yaml_serde` is an API-compatible fork whose only substantive changes are `no_std`
+support and lint cleanups, so this is behavior-preserving: the bytes pks writes to
+`package.yml` and `package_todo.yml` are unchanged, as are its YAML parse error
+messages. No action is required.

Cargo.toml

@@ -15,6 +15,22 @@ repository = "https://github.com/rubyatscale/pks"
 [profile.dev]
 debug = true
 
+# `cargo build --release` is what dev/run_benchmarks.sh measures and what people
+# build locally, so it should be optimized like the shipped binary. This profile
+# was previously left at cargo defaults (lto = false, codegen-units = 16), which
+# meant benchmarks understated the `dist` build.
+#
+# Measured on a 51k-file app: default profile 5.289s, lto="thin" 5.127s,
+# lto="fat" 5.433s. Fat LTO is both slower to build (42s vs 27s) and slower to
+# run, so "thin" it is -- which also matches the dist profile.
+#
+# codegen-units = 1 costs some release build time in exchange for a faster binary
+# and, just as usefully, far less run-to-run variance (+/-0.084s -> +/-0.010s),
+# without which changes worth a few percent cannot be told apart from noise.
+[profile.release]
+lto = "thin"
+codegen-units = 1
+
 # The profile that 'dist' will build with
 [profile.dist]
 inherits = "release"
@@ -39,7 +55,7 @@ path-clean = "1.0.1"                                                   # Pathnam
 rayon = "1.7.0"                                                        # for parallel iteration
 regex = "1.7.3"
 serde = { version = "~1", features = ["derive"] }                      # de(serialization)
-serde_yaml = "0.9.19"                                                  # de(serialization)
+yaml_serde = "0.10.6"                                                  # de(serialization)
 serde_json = "1.0.96"                                                  # de(serialization)
 serde_magnus = "0.7.0"                                                 # permits a ruby gem to interface with this library
 tracing = "0.1.37"                                                     # logging