[czareko]

Summary

Aligns the Rust toolchain and CI configuration with our consumer repo
Quantus-Network/chain, and adds
two non-blocking security signals (cargo audit + CodeQL) plus least-privilege
permissions for all workflows.

Changes

• Pin Rust toolchain to 1.93.0 (matches chain/rust-toolchain), with
  target wasm32v1-none. Every CI job now does rustup show up-front so the
  pinned toolchain is installed and logged explicitly instead of relying on the
  runner's default stable.
• Add 🔐 Security Audit job in ci.yml running cargo audit. Marked
  continue-on-error: true because all current findings come transitively
  through the Substrate stack (sp-runtime 45 → sp-io 44 → ...) and cannot
  be fixed from this repo. See follow-up issue for the resolution plan.
• Add CodeQL workflow (.github/workflows/codeql.yml) scanning both
  actions (workflow hygiene) and rust (taint/quality) with the
  security-and-quality query set, build-mode none. Mirrors the setup
  in qp-rusty-crystals.
• Add least-privilege permissions: contents: read at workflow level in
  ci.yml, create-release-proposal.yml and create-release-tag-and-publish.yml.
  Per-job contents: write overrides are kept where actually needed (tag push,
  release creation, version-bump PR).

Notes

• chain itself does not run cargo audit and pins the same sp-* versions,
  so the same vulnerabilities exist there transitively. Tracking long-term
  resolution in a separate issue rather than blocking this PR.
• Changing the wasm target from wasm32-unknown-unknown to wasm32v1-none
  in rust-toolchain has no effect on the actual build (no --target is
  passed in CI and there is no runtime crate in this workspace) — it is
  purely a consistency change with chain.

[ethan-crypto]

Overall looks good, I think we just need to make sure we aren't accidentally double-running Code QL (and fix the audit issue ofc)

[ethan-crypto]

@czareko you mentioned that CodeQL requires switching from default setup to advanced setup... We should add a merge checklist note or issue link for disabling/switching CodeQL default setup once this workflow lands. Current checks show both “CodeQL on: dynamic” and this new workflow running, so we may double-run CodeQL until the repo setting is changed.

[czareko]

@ethan-crypto, my comment in the test section was outdated. From the repo perspective, everything is now disabled, and the configuration is fully managed from our code. This way, we can keep it consistent across all projects.

[ethan-crypto]

Overall looks good. IMO I think we should move continue-on-error: true from the security-audit job to the Run cargo audit step to keep the audit informational while avoiding a failed check in the PR UI.

[ethan-crypto]

Suggested change

continue-on-error: true

[ethan-crypto]

Suggested change

	run: cargo audit
	continue-on-error: true
	run: cargo audit

[ethan-crypto]

LGTM