- actions/checkout: v4 → 11d5960a326750d5838078e36cf38b85af677262 - actions/setup-python: v5 → a26af69be951a213d495a4c3e4e4022e16d87065 - actions/upload-artifact: v4 → ea165f8d65b6e75b540449e92b4886f43607fa02 - dtolnay/rust-toolchain: stable → 686976e191b89faba57d3206551f0f330d8cb249 - Swatinem/rust-cache: v2 → 49a0bdc70d2e1b713ca9e2869b211fcce03d3c1c - softprops/action-gh-release: v2 → 3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 Improves supply chain security by pinning Actions to specific commits instead of mutable tag references, preventing unexpected behavior changes if action maintainers update tags. Fixes #3287
All cargo commands were running from repo root where no Cargo.toml exists. This was causing build/test/clippy/fmt failures for every PR with Rust changes. Fixes: #3095, #3096 CI failures.
Adds .github/workflows/rust.yml with cargo build and test on push/PR to main.