ci(deps): bump actions/checkout from 4.4.0 to 7.0.1 in /.github/workflows

.github/workflows/ci.yml

@@ -28,7 +28,7 @@ jobs:
     timeout-minutes: 20
     steps:
       # actions/checkout v4.1.7, pinned by immutable commit SHA.
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       # dtolnay/rust-toolchain, pinned by immutable commit SHA.
       - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772
         with:
@@ -51,7 +51,7 @@ jobs:
     timeout-minutes: 15
     steps:
       # actions/checkout v4.1.7, pinned by immutable commit SHA.
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       # dtolnay/rust-toolchain, pinned by immutable commit SHA.
       - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772
         with:
@@ -70,7 +70,7 @@ jobs:
     timeout-minutes: 20
     steps:
       # actions/checkout v4.1.7, pinned by immutable commit SHA.
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       # dtolnay/rust-toolchain, pinned by immutable commit SHA.
       - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772
         with:
@@ -86,7 +86,7 @@ jobs:
     timeout-minutes: 20
     steps:
       # actions/checkout v4.1.7, pinned by immutable commit SHA.
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       # dtolnay/rust-toolchain, pinned by immutable commit SHA.
       - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772
         with:

.github/workflows/codeql.yml

@@ -26,15 +26,13 @@ jobs:
     timeout-minutes: 25
     steps:
       # actions/checkout v4.1.7, pinned by immutable commit SHA.
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
+        uses: github/codeql-action/init@v4
         with:
           languages: rust
-          build-mode: manual
-      - name: Build all Rust features
-        run: cargo build --workspace --all-features --locked
+          build-mode: none
       - name: Analyze
-        uses: github/codeql-action/analyze@v3
+        uses: github/codeql-action/analyze@v4
         with:
           category: "/language:rust"

.github/workflows/coverage.yml

@@ -27,18 +27,18 @@ jobs:
     timeout-minutes: 25
     steps:
       # actions/checkout v4.1.7, pinned by immutable commit SHA.
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       # dtolnay/rust-toolchain, pinned by immutable commit SHA.
       - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772
         with:
           toolchain: stable
           components: llvm-tools-preview
       - name: Install locked coverage tool
-        run: cargo install cargo-llvm-cov --version 0.9.0 --locked
+        run: cargo +stable install cargo-llvm-cov --version 0.9.0 --locked
       - name: Generate LCOV and text report
         run: |
-          cargo llvm-cov --workspace --all-features --locked --lcov --output-path lcov.info
-          cargo llvm-cov --workspace --all-features --locked --summary-only | tee coverage-summary.txt
+          cargo +stable llvm-cov --workspace --all-features --locked --lcov --output-path lcov.info
+          cargo +stable llvm-cov --workspace --all-features --locked --summary-only | tee coverage-summary.txt
       # actions/upload-artifact v4 is kept current by Dependabot.
       - uses: actions/upload-artifact@v4
         with:

.github/workflows/fuzz.yml

@@ -26,7 +26,7 @@ jobs:
     timeout-minutes: 30
     steps:
       # actions/checkout v4.1.7, pinned by immutable commit SHA.
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       # dtolnay/rust-toolchain, pinned by immutable commit SHA.
       - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772
         with:

.github/workflows/release.yml

@@ -32,7 +32,7 @@ jobs:
     timeout-minutes: 20
     steps:
       # actions/checkout v4.1.7, pinned by immutable commit SHA.
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       # dtolnay/rust-toolchain, pinned by immutable commit SHA.
       - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772
         with:
@@ -57,7 +57,7 @@ jobs:
     timeout-minutes: 30
     steps:
       # actions/checkout v4.1.7, pinned by immutable commit SHA.
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       # dtolnay/rust-toolchain, pinned by immutable commit SHA.
       - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772
         with:

.github/workflows/security.yml

@@ -31,33 +31,33 @@ jobs:
     timeout-minutes: 15
     steps:
       # actions/checkout v4.1.7, pinned by immutable commit SHA.
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       # dtolnay/rust-toolchain, pinned by immutable commit SHA.
       - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772
         with:
           toolchain: stable
       - name: Install locked audit tool
-        run: cargo install cargo-audit --version 0.22.2 --locked
+        run: cargo +stable install cargo-audit --version 0.22.2 --locked
       - name: Fail on vulnerable, yanked, or unmaintained dependencies
-        run: cargo audit --deny warnings
+        run: cargo +stable audit --deny warnings
 
   policy:
     name: License and source policy
     runs-on: ubuntu-24.04
     timeout-minutes: 20
     steps:
       # actions/checkout v4.1.7, pinned by immutable commit SHA.
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       # dtolnay/rust-toolchain, pinned by immutable commit SHA.
       - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772
         with:
           toolchain: stable
       - name: Install locked dependency-policy tool
-        run: cargo install cargo-deny --version 0.20.2 --locked
+        run: cargo +stable install cargo-deny --version 0.20.2 --locked
       - name: Enforce advisory, license, duplicate, ban, and source policy
-        run: cargo deny check all
+        run: cargo +stable deny check all
       - name: Record dependency graph for review
-        run: cargo tree --workspace --all-features --locked > dependency-tree.txt
+        run: cargo +stable tree --workspace --all-features --locked > dependency-tree.txt
       # actions/upload-artifact v4 is kept current by Dependabot.
       - uses: actions/upload-artifact@v4
         with:

.gitignore

@@ -2,4 +2,3 @@
 /fuzz/target
 /fuzz/corpus
 /fuzz/artifacts
-Cargo.lock