chore: Align Rust toolchain & CI with chain repo

.github/actions/macos/action.yml

@@ -0,0 +1,52 @@
+---
+name: macos dependencies
+description: installs dependencies required to compile the workspace on macos
+
+runs:
+  using: composite
+  steps:
+    - name: rust compilation prerequisites (macos)
+      run: |
+        # `brew update` is intentionally non-fatal: it occasionally fails on
+        # transient tap/network errors, and we don't want it to short-circuit
+        # the retry loop below before `brew install` even gets a chance.
+        brew update || echo "::warning::brew update failed (non-fatal), continuing"
+        OK=0
+        for i in 1 2 3; do
+          if brew install protobuf llvm; then OK=1; break; fi
+          echo "brew install attempt $i failed (often transient ghcr.io), retrying in 15s..."
+          sleep 15
+        done
+        if [ "$OK" -ne 1 ]; then echo "::error::brew install protobuf llvm failed after 3 attempts"; exit 1; fi
+        # Unconditionally install the toolchain pinned in rust-toolchain.toml
+        # (rustup >=1.28 no longer auto-installs the active toolchain, and
+        # `rustup update` only refreshes already-installed toolchains).
+        # This installs the channel + every component/target listed in the file
+        # (no extra `rustup target add` needed — the workspace doesn't compile
+        # to any wasm target in CI anyway).
+        rustup toolchain install
+        rustup component add clippy rust-src
+        rustc --version
+        cargo --version
+      shell: bash
+    - name: Set LIBCLANG_PATH for clang-sys (bindgen/rocksdb etc.)
+      run: |
+        # Homebrew LLVM provides libclang.dylib; clang-sys looks for libclang.dylib.
+        # ARM (Apple Silicon): /opt/homebrew/opt/llvm/lib
+        # x86 (Intel):         /usr/local/opt/llvm/lib
+        DIR=
+        if command -v brew >/dev/null 2>&1; then
+          PREFIX="$(brew --prefix llvm 2>/dev/null)"
+          [ -n "$PREFIX" ] && [ -d "$PREFIX/lib" ] && ls "$PREFIX/lib"/libclang*.dylib 1>/dev/null 2>&1 && DIR="$PREFIX/lib"
+        fi
+        if [ -z "$DIR" ] && [ -d /usr/local/opt/llvm/lib ] && ls /usr/local/opt/llvm/lib/libclang*.dylib 1>/dev/null 2>&1; then
+          DIR=/usr/local/opt/llvm/lib
+        fi
+        if [ -z "$DIR" ] && [ -d /opt/homebrew/opt/llvm/lib ] && ls /opt/homebrew/opt/llvm/lib/libclang*.dylib 1>/dev/null 2>&1; then
+          DIR=/opt/homebrew/opt/llvm/lib
+        fi
+        if [ -n "$DIR" ]; then
+          echo "LIBCLANG_PATH=$DIR" >> $GITHUB_ENV
+        fi
+        echo "LIBCLANG_PATH=${LIBCLANG_PATH:-not set}"
+      shell: bash

.github/actions/ubuntu/action.yml

@@ -0,0 +1,55 @@
+---
+name: ubuntu dependencies
+description: installs dependencies required to compile the workspace on ubuntu
+
+runs:
+  using: composite
+  steps:
+    - name: rust compilation prerequisites (ubuntu)
+      run: |
+        sudo apt-get update -yqq
+        sudo apt-get install -yqq --no-install-recommends \
+          libclang-dev \
+          clang \
+          protobuf-compiler
+        # Unconditionally install the toolchain pinned in rust-toolchain.toml
+        # (rustup >=1.28 no longer auto-installs the active toolchain, and
+        # `rustup update` only refreshes already-installed toolchains).
+        # This installs the channel + every component/target listed in the file
+        # (no extra `rustup target add` needed — the workspace doesn't compile
+        # to any wasm target in CI anyway).
+        rustup toolchain install
+        # `cargo +nightly fmt` is used by the fast-checks job (ubuntu-only),
+        # so we need rustfmt for the nightly toolchain preinstalled on the
+        # runner. clippy/rust-src are for the pinned stable toolchain.
+        rustup component add rustfmt --toolchain nightly
+        rustup component add clippy rust-src
+        rustc --version
+        cargo --version
+      shell: bash
+    - name: Set LIBCLANG_PATH for clang-sys (bindgen/rocksdb etc.)
+      run: |
+        # Runner may set wrong LIBCLANG_PATH; use known dirs then find then llvm-config.
+        DIR=
+        for ver in 18 17 16 15 14; do
+          D="/usr/lib/llvm-$ver/lib"
+          if [ -d "$D" ] && ls "$D"/libclang*.so* 1>/dev/null 2>&1; then
+            DIR=$D
+            break
+          fi
+        done
+        if [ -z "$DIR" ]; then
+          LIB=$(find /usr -name 'libclang.so*' \( -type f -o -type l \) 2>/dev/null | head -1)
+          [ -n "$LIB" ] && DIR=$(dirname "$LIB")
+        fi
+        if [ -z "$DIR" ] && command -v llvm-config >/dev/null 2>&1; then
+          D=$(llvm-config --libdir 2>/dev/null)
+          if [ -n "$D" ] && [ -d "$D" ] && ls "$D"/libclang*.so* 1>/dev/null 2>&1; then
+            DIR=$D
+          fi
+        fi
+        if [ -n "$DIR" ] && [ "$DIR" != "." ]; then
+          echo "LIBCLANG_PATH=$DIR" >> $GITHUB_ENV
+        fi
+        echo "LIBCLANG_PATH=${LIBCLANG_PATH:-not set}"
+      shell: bash

.github/workflows/ci.yml

@@ -19,19 +19,25 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+# Principle of least privilege: all jobs only read the repo (checkout + cargo).
+# Per-job override is unnecessary because no job pushes, creates releases or PRs.
+permissions:
+  contents: read
+
 env:
   CARGO_INCREMENTAL: 0
   CARGO_TERM_COLOR: always
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+  CARGO_NET_RETRY: 10
+  CARGO_NET_TIMEOUT: 60
 
 jobs:
   fast-checks:
     name: 🏁 Fast Checks (Format)
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v4
-      - name: Install required components
-        run: rustup component add rustfmt --toolchain nightly
+      - uses: actions/checkout@v5
+      - uses: ./.github/actions/ubuntu
       - name: Install taplo
         run: cargo install taplo-cli --locked
       - name: Run format checks
@@ -43,25 +49,31 @@ jobs:
     name: 🛠️ Build & Test Matrix
     needs: fast-checks
     runs-on: ${{ matrix.os }}
+    timeout-minutes: 45
     strategy:
       fail-fast: true
       matrix:
         os:
           - ubuntu-latest
           - macos-latest
     steps:
-      - uses: actions/checkout@v4
-      - name: Install dependencies (Ubuntu)
+      - uses: actions/checkout@v5
+      - name: Setup Ubuntu
         if: matrix.os == 'ubuntu-latest'
-        run: |
-          sudo apt-get update -yqq
-          sudo apt-get install -yqq --no-install-recommends \
-            libclang-dev \
-            protobuf-compiler
-      - name: Install dependencies (macOS)
+        uses: ./.github/actions/ubuntu
+      - name: Setup macOS
         if: matrix.os == 'macos-latest'
-        run: |
-          brew install protobuf
+        uses: ./.github/actions/macos
+      - name: Cache cargo registry & target
+        uses: actions/cache@v5
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+          key: ${{ runner.os }}-cargo-build-${{ hashFiles('**/Cargo.lock', 'rust-toolchain.toml') }}
+          restore-keys: |
+            ${{ runner.os }}-cargo-build-
       - name: Build
         run: cargo build --locked --release
       - name: Test
@@ -71,17 +83,52 @@ jobs:
     name: 🤖 Analysis (Clippy & Doc)
     needs: fast-checks
     runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v5
+      - uses: ./.github/actions/ubuntu
+      - name: Cache cargo registry & target
+        uses: actions/cache@v5
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+          key: ${{ runner.os }}-cargo-analysis-${{ hashFiles('**/Cargo.lock', 'rust-toolchain.toml') }}
+          restore-keys: |
+            ${{ runner.os }}-cargo-analysis-
+      - name: Run clippy (workspace, all targets, all features)
+        run: cargo clippy --workspace --all-targets --all-features --locked --release -- -D warnings
+      - name: Generate documentation (workspace)
+        run: cargo doc --workspace --locked --no-deps --all-features --release
+
+  security-audit:
+    name: 🔐 Security Audit (non-blocking)
+    needs: fast-checks
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
-      - name: Install Rust
+      - uses: actions/checkout@v5
+      - name: Cache cargo-audit binary
+        uses: actions/cache@v5
+        with:
+          path: ~/.cargo/bin/cargo-audit
+          key: cargo-audit-bin-${{ runner.os }}-0.22.1
+      - name: Cache RustSec advisory database
+        uses: actions/cache@v5
+        with:
+          path: ~/.cargo/advisory-db
+          key: cargo-advisory-db-${{ runner.os }}-${{ github.run_id }}
+          restore-keys: |
+            cargo-advisory-db-${{ runner.os }}-
+      - name: Install cargo-audit
         run: |
-          sudo apt-get update -yqq
-          sudo apt-get install -yqq --no-install-recommends \
-            libclang-dev \
-            protobuf-compiler
-      - name: Install required components
-        run: rustup component add rust-src clippy
-      - name: Run clippy
-        run: cargo clippy --locked -- -D warnings
-      - name: Run doc
-        run: cargo doc --locked --no-deps
+          if ! command -v cargo-audit >/dev/null 2>&1; then
+            cargo install cargo-audit --locked --version 0.22.1
+          fi
+      - name: Run cargo audit (informational only)
+        # Only this step is non-blocking — every other step in this job
+        # (checkout, caches, cargo-audit install) must fail loudly so we
+        # don't silently skip the audit.
+        continue-on-error: true
+        run: cargo audit

.github/workflows/codeql.yml

@@ -0,0 +1,50 @@
+---
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+# No scheduled scans by design: every code change reaches main via push or PR,
+# both of which trigger this workflow. Security advisories for Rust dependencies
+# are independently caught by `cargo audit` in ci.yml.
+
+permissions:
+  contents: read
+  security-events: write
+  actions: read
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          # `actions` covers GitHub Actions workflow hygiene (e.g. the
+          # `actions/missing-workflow-permissions` rule).
+          - language: actions
+            build-mode: none
+          # `rust` is GA since Oct 2025 and supports build-mode `none`,
+          # so we get source-level analysis without compiling the workspace.
+          # Note: `cargo audit` in ci.yml stays as the authoritative source
+          # for known CVEs in dependencies; CodeQL adds taint/quality checks
+          # on our own source.
+          - language: rust
+            build-mode: none
+    steps:
+      - uses: actions/checkout@v5
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: ${{ matrix.build-mode }}
+          queries: security-and-quality
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v4
+        with:
+          category: "/language:${{ matrix.language }}"

.github/workflows/create-release-proposal.yml

@@ -1,8 +1,15 @@
 name: Create Release Proposal
 
+# Default least-privilege permissions for all jobs in this workflow.
+# Jobs that need write access (e.g. branch push + PR creation) override
+# this with their own `permissions:` block.
+permissions:
+  contents: read
+
 env:
   CARGO_TERM_COLOR: always
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+  CARGO_NET_RETRY: 10
+  CARGO_NET_TIMEOUT: 60
 
 on:
   workflow_dispatch:
@@ -35,13 +42,14 @@ jobs:
   calculate-next-version:
     name: 🧮 Calculate Next Version
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     outputs:
       new_version: ${{ steps.versioner.outputs.new_version }}
       commit_sha_short: ${{ steps.vars.outputs.commit_sha_short }}
       source_branch: ${{ steps.vars.outputs.source_branch }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0
           fetch-tags: true
@@ -114,11 +122,12 @@ jobs:
     name: 📝 Update version files
     needs: calculate-next-version
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     permissions:
       contents: write
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0