[prabod]

Third-party actions referenced by tag (@v4, @stable) run whatever the tag points to today, so a compromised upstream can push new code under the same tag. The release job runs these actions with contents: write and the crates.io token in reach.

• Every uses: across the 5 workflows is now pinned to the commit its tag currently resolves to, with the exact version in a comment (actions/checkout@11d5960… # v4.4.0). Same code as today, so behaviour shouldn't change.
• dtolnay/rust-toolchain is pinned to its stable branch's head. That commit's toolchain input defaults to stable, so no with: change is needed. Dependabot can't bump a branch pin, so update this one by hand occasionally.
• .github/dependabot.yml: a weekly grouped PR keeps the pinned SHAs current. Rust security updates come from Dependabot security updates, which are now enabled in settings.

After this merges, Settings → Actions → General → "Require actions to be pinned to a full-length commit SHA" can be turned on, so new unpinned actions get rejected.

[IsuraManchanayake]

Merged main into this branch (0a59a82) and resolved release.yml: the crates-verify and crates jobs keep the pins #32 gave them (actions/checkout v7.0.1 at 3d3c42e5, dtolnay/rust-toolchain master at 683b588c with Rust 1.99.1), since those built v0.1.5; the build and release jobs take this branch's v4.4.0 / stable pins. 1c64d5a pins the one uses: #32 added after this branch was cut, the packaging job's actions/checkout@v4, to the same v4.4.0 commit. Every SHA in both PRs resolves to the tag or branch head its comment names (checked against the GitHub API), and no uses: in the six workflows is left on a tag; publish.yml was already pinned by #32. #41's crates-io and nightly environments came through the merge untouched, so the diff against main is the pins and dependabot.yml only.

rc branch only fails here because #40 landed first and this branch is not an rc-*. It is not a required check yet, so a main-maintainer can still merge this; otherwise it needs re-opening from the next rc branch.