fix(ci): pin toolchain, and switch to

`actions-rust-lang/setup-rust-toolchain`

- switch to `action-rust-lang/setup-rust-toolchain`.
- pin toolchain to `nightly-2025-11-27`, this fixes a CI failure resulting
  from use of rustc nightly with `llvm-cov`.
- adds `zizmor.yml` config file, allow
  `actions-rust-lang/setup-rust-toolchain` ref-pin.

diff --git a/.github/workflows/code_coverage.yml b/.github/workflows/code_coverage.yml
index d6d8e9acf1ff4e7c083a5ae3be61334a13953343..11f507af1e14dd23f14eb4d495cc7ea9e6bf7d6a 100644 (file)
--- a/.github/workflows/code_coverage.yml
+++ b/.github/workflows/code_coverage.yml
@@ -16,20 +16,18 @@ jobs:
       - name: Install lcov tools
         run: sudo apt-get install lcov -y
       - name: Install Rust toolchain
-        uses: actions-rs/toolchain@v1
+        uses: actions-rust-lang/setup-rust-toolchain@v1
         with:
-            toolchain: nightly
+            toolchain: nightly-2025-11-27
             override: true
-            profile: minimal
+            cache: true
             components: llvm-tools-preview
-      - name: Rust Cache
-        uses: Swatinem/rust-cache@v2.7.8
       - name: Install cargo-llvm-cov
         run: if [[ ! -e ~/.cargo/bin/cargo-llvm-cov ]]; then cargo install cargo-llvm-cov; fi
       - name: Make coverage directory
         run: mkdir coverage
       - name: Test and report coverage
-        run: cargo +nightly llvm-cov -q --doctests --branch --all --ignore-filename-regex "(example*|crates/testenv/*)" --all-features --lcov --output-path ./coverage/lcov.info
+        run: cargo llvm-cov -q --doctests --branch --all --ignore-filename-regex "(example*|crates/testenv/*)" --all-features --lcov --output-path ./coverage/lcov.info
       - name: Generate HTML coverage report
         run: genhtml -o coverage-report.html --ignore-errors unmapped ./coverage/lcov.info
       - name: Coveralls upload

diff --git a/.github/zizmor.yml b/.github/zizmor.yml
new file mode 100644 (file)
index 0000000..956f30d
--- /dev/null
+++ b/.github/zizmor.yml
@@ -0,0 +1,7 @@
+# Zizmor config
+rules:
+  unpinned-uses:
+    config:
+      policies:
+        # Allow pin by ref/tag
+        actions-rust-lang/setup-rust-toolchain: ref-pin