use sparse protocol on CI

.github/workflows/ci.yml

@@ -1,6 +1,3 @@
-# Based on https://github.com/rust-lang/regex/blob/9582040009820380a16819ca0d1ae262c7d454b0/.github/workflows/ci.yml
-# and https://github.com/Keats/validator/blob/09efa7e78e6fbc853a6a56af6904a00e2e6632b8/.github/workflows/ci.yml
-
 name: ci
 on:
   pull_request:
@@ -15,31 +12,19 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
-# The section is needed to drop write-all permissions that are granted on
-# `schedule` event. By specifying any permission explicitly all others are set
-# to none. By using the principle of least privilege the damage a compromised
-# workflow can do (because of an injection or compromised third party tool or
-# action) is restricted. Currently the worklow doesn't need any additional
-# permission except for pulling the code. Adding labels to issues, commenting
-# on pull-requests, etc. may need additional permissions:
-#
-# Syntax for this section:
-# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
-#
-# Reference for how to assign permissions on a job-by-job basis:
-# https://docs.github.com/en/actions/using-jobs/assigning-permissions-to-jobs
-#
-# Reference for available permissions that we can enable if needed:
-# https://docs.github.com/en/actions/security-guides/automatic-token-authentication#permissions-for-the-github_token
 permissions:
   # to fetch code (actions/checkout)
   contents: read
 
+env:
+  # https://doc.rust-lang.org/cargo/reference/config.html#registriescrates-ioprotocol
+  CARGO_REGISTRIES_CRATES_IO_PROTOCOL: "sparse"
+
 jobs:
   test-wasm:
     name: Test WASM
     runs-on: ubuntu-20.04
-    
+
     steps:
       - name: Checkout repository
         uses: actions/checkout@v3