ci: pin actions, add timeouts and concurrency, real release toolchain (#13)

- SHA-pin every third-party action with a version comment; weekly
  grouped dependabot keeps pins current
- timeout-minutes on all jobs; per-ref cancel concurrency for CI and a
  fixed-group queue for release
- toolchain via actions-rust-lang/setup-rust-toolchain (reads
  rust-toolchain.toml, built-in cache); the release build gets a real
  toolchain + target step instead of leaning on the runner default

Author: johncarmack1984

.github/dependabot.yml

@@ -0,0 +1,14 @@
+# Dependabot version updates. Security updates (the alerts) are a separate repo
+# setting and stay on. This keeps the SHA-pinned actions current -- Dependabot
+# bumps the pin and its version comment together.
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    groups:
+      actions:
+        patterns: ["*"]
+    commit-message:
+      prefix: "ci"

.github/workflows/ci.yml

@@ -16,15 +16,20 @@ permissions:
 env:
   CARGO_TERM_COLOR: always
 
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   test:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v7
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      # Reads the channel from rust-toolchain.toml; brings built-in caching.
+      - uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
         with:
           components: clippy, rustfmt
-      - uses: Swatinem/rust-cache@v2
       - name: Install glslang (provides glslangValidator)
         run: sudo apt-get update && sudo apt-get install -y glslang-tools
       - name: Format

.github/workflows/release.yml

@@ -14,20 +14,26 @@ permissions:
   contents: write
   pull-requests: write
 
+concurrency:
+  group: release
+  cancel-in-progress: false
+
 jobs:
   release-please:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     outputs:
       release_created: ${{ steps.release.outputs.release_created }}
       tag_name: ${{ steps.release.outputs.tag_name }}
     steps:
-      - uses: googleapis/release-please-action@v5
+      - uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
         id: release
 
   build:
     needs: release-please
     if: ${{ needs.release-please.outputs.release_created == 'true' }}
     runs-on: ${{ matrix.os }}
+    timeout-minutes: 45
     strategy:
       fail-fast: false
       matrix:
@@ -39,9 +45,12 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v7
-      - name: Install Rust target
-        run: rustup target add ${{ matrix.target }}
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      # Real toolchain step: reads the channel from rust-toolchain.toml and
+      # installs the cross target, instead of leaning on the runner default.
+      - uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
+        with:
+          target: ${{ matrix.target }}
       - name: Build
         run: cargo build --release --locked --target ${{ matrix.target }}
       - name: Stage asset (unix)
@@ -65,15 +74,16 @@ jobs:
     needs: release-please
     if: ${{ needs.release-please.outputs.release_created == 'true' }}
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     env:
       OVSX_PAT: ${{ secrets.OVSX_PAT }}
       VSCE_PAT: ${{ secrets.VSCE_PAT }}
     defaults:
       run:
         working-directory: editors/vscode
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 'lts/*'
       - run: npm ci