ci(deps): bump actions/upload-artifact from 4 to 7 in /.github/workflows

.github/workflows/codeql.yml

@@ -28,13 +28,11 @@ jobs:
       # actions/checkout v4.1.7, pinned by immutable commit SHA.
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
+        uses: github/codeql-action/init@v4
         with:
           languages: rust
-          build-mode: manual
-      - name: Build all Rust features
-        run: cargo build --workspace --all-features --locked
+          build-mode: none
       - name: Analyze
-        uses: github/codeql-action/analyze@v3
+        uses: github/codeql-action/analyze@v4
         with:
           category: "/language:rust"

.github/workflows/coverage.yml

@@ -34,13 +34,13 @@ jobs:
           toolchain: stable
           components: llvm-tools-preview
       - name: Install locked coverage tool
-        run: cargo install cargo-llvm-cov --version 0.9.0 --locked
+        run: cargo +stable install cargo-llvm-cov --version 0.9.0 --locked
       - name: Generate LCOV and text report
         run: |
-          cargo llvm-cov --workspace --all-features --locked --lcov --output-path lcov.info
-          cargo llvm-cov --workspace --all-features --locked --summary-only | tee coverage-summary.txt
+          cargo +stable llvm-cov --workspace --all-features --locked --lcov --output-path lcov.info
+          cargo +stable llvm-cov --workspace --all-features --locked --summary-only | tee coverage-summary.txt
       # actions/upload-artifact v4 is kept current by Dependabot.
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: cfr-coverage
           path: |

.github/workflows/security.yml

@@ -37,9 +37,9 @@ jobs:
         with:
           toolchain: stable
       - name: Install locked audit tool
-        run: cargo install cargo-audit --version 0.22.2 --locked
+        run: cargo +stable install cargo-audit --version 0.22.2 --locked
       - name: Fail on vulnerable, yanked, or unmaintained dependencies
-        run: cargo audit --deny warnings
+        run: cargo +stable audit --deny warnings
 
   policy:
     name: License and source policy
@@ -53,13 +53,13 @@ jobs:
         with:
           toolchain: stable
       - name: Install locked dependency-policy tool
-        run: cargo install cargo-deny --version 0.20.2 --locked
+        run: cargo +stable install cargo-deny --version 0.20.2 --locked
       - name: Enforce advisory, license, duplicate, ban, and source policy
-        run: cargo deny check all
+        run: cargo +stable deny check all
       - name: Record dependency graph for review
-        run: cargo tree --workspace --all-features --locked > dependency-tree.txt
+        run: cargo +stable tree --workspace --all-features --locked > dependency-tree.txt
       # actions/upload-artifact v4 is kept current by Dependabot.
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: cfr-dependency-tree
           path: dependency-tree.txt

.gitignore

@@ -2,4 +2,3 @@
 /fuzz/target
 /fuzz/corpus
 /fuzz/artifacts
-Cargo.lock