chore: Align Rust toolchain & CI with chain repo

.github/workflows/ci.yml

@@ -19,6 +19,11 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+# Principle of least privilege: all jobs only read the repo (checkout + cargo).
+# Per-job override is unnecessary because no job pushes, creates releases or PRs.
+permissions:
+  contents: read
+
 env:
   CARGO_INCREMENTAL: 0
   CARGO_TERM_COLOR: always
@@ -30,8 +35,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - name: Install required components
-        run: rustup component add rustfmt --toolchain nightly
+      - name: Setup Rust toolchain (pinned via rust-toolchain)
+        run: |
+          rustup show active-toolchain || rustup show
+          rustup component add rustfmt --toolchain nightly
       - name: Install taplo
         run: cargo install taplo-cli --locked
       - name: Run format checks
@@ -62,6 +69,11 @@ jobs:
         if: matrix.os == 'macos-latest'
         run: |
           brew install protobuf
+      - name: Setup Rust toolchain (pinned via rust-toolchain)
+        run: |
+          rustup show active-toolchain || rustup show
+          rustc --version
+          cargo --version
       - name: Build
         run: cargo build --locked --release
       - name: Test
@@ -73,15 +85,51 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - name: Install Rust
+      - name: Install system dependencies
         run: |
           sudo apt-get update -yqq
           sudo apt-get install -yqq --no-install-recommends \
             libclang-dev \
             protobuf-compiler
-      - name: Install required components
-        run: rustup component add rust-src clippy
+      - name: Setup Rust toolchain (pinned via rust-toolchain)
+        run: |
+          rustup show active-toolchain || rustup show
+          rustup component add rust-src clippy
+          rustc --version
+          cargo --version
       - name: Run clippy
         run: cargo clippy --locked -- -D warnings
       - name: Run doc
         run: cargo doc --locked --no-deps
+
+  security-audit:
+    name: 🔐 Security Audit (non-blocking)
+    needs: fast-checks
+    runs-on: ubuntu-latest
+    continue-on-error: true
+    steps:
+      - uses: actions/checkout@v4
+      - name: Setup Rust toolchain (pinned via rust-toolchain)
+        run: |
+          rustup show active-toolchain || rustup show
+          rustc --version
+          cargo --version
+      - name: Cache cargo-audit binary
+        uses: actions/cache@v4
+        with:
+          path: ~/.cargo/bin/cargo-audit
+          key: cargo-audit-bin-${{ runner.os }}
+      - name: Cache RustSec advisory database
+        uses: actions/cache@v4
+        with:
+          path: ~/.cargo/advisory-db
+          key: cargo-advisory-db-${{ runner.os }}-${{ github.run_id }}
+          restore-keys: |
+            cargo-advisory-db-${{ runner.os }}-
+      - name: Install cargo-audit
+        run: |
+          if ! command -v cargo-audit >/dev/null 2>&1; then
+            cargo install cargo-audit --locked
+          fi
+      - name: Run cargo audit (informational only)
+        run: cargo audit

.github/workflows/codeql.yml

@@ -0,0 +1,50 @@
+---
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+# No scheduled scans by design: every code change reaches main via push or PR,
+# both of which trigger this workflow. Security advisories for Rust dependencies
+# are independently caught by `cargo audit` in ci.yml.
+
+permissions:
+  contents: read
+  security-events: write
+  actions: read
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          # `actions` covers GitHub Actions workflow hygiene (e.g. the
+          # `actions/missing-workflow-permissions` rule).
+          - language: actions
+            build-mode: none
+          # `rust` is GA since Oct 2025 and supports build-mode `none`,
+          # so we get source-level analysis without compiling the workspace.
+          # Note: `cargo audit` in ci.yml stays as the authoritative source
+          # for known CVEs in dependencies; CodeQL adds taint/quality checks
+          # on our own source.
+          - language: rust
+            build-mode: none
+    steps:
+      - uses: actions/checkout@v5
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: ${{ matrix.build-mode }}
+          queries: security-and-quality
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v4
+        with:
+          category: "/language:${{ matrix.language }}"

.github/workflows/create-release-proposal.yml

@@ -1,5 +1,11 @@
 name: Create Release Proposal
 
+# Default least-privilege permissions for all jobs in this workflow.
+# Jobs that need write access (e.g. branch push + PR creation) override
+# this with their own `permissions:` block.
+permissions:
+  contents: read
+
 env:
   CARGO_TERM_COLOR: always
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

.github/workflows/create-release-tag-and-publish.yml

@@ -1,5 +1,11 @@
 name: Create Release Tag & Publish
 
+# Default least-privilege permissions for all jobs in this workflow.
+# Jobs that need write access (e.g. tag push, GitHub release) override
+# this with their own `permissions:` block.
+permissions:
+  contents: read
+
 env:
   CARGO_INCREMENTAL: 0
   CARGO_TERM_COLOR: always
@@ -63,8 +69,12 @@ jobs:
         with:
           ref: ${{ needs.create-tag.outputs.version }}
 
-      - name: Install required components
-        run: rustup component add rustfmt --toolchain nightly
+      - name: Setup Rust toolchain (pinned via rust-toolchain)
+        run: |
+          rustup show active-toolchain || rustup show
+          rustup component add rustfmt --toolchain nightly
+          rustc --version
+          cargo --version
 
       - name: Install taplo
         run: cargo install taplo-cli --locked
@@ -91,8 +101,12 @@ jobs:
             libclang-dev \
             protobuf-compiler
 
-      - name: Install required components
-        run: rustup component add rust-src clippy
+      - name: Setup Rust toolchain (pinned via rust-toolchain)
+        run: |
+          rustup show active-toolchain || rustup show
+          rustup component add rust-src clippy
+          rustc --version
+          cargo --version
 
       - name: Build
         run: cargo build --locked --release

rust-toolchain

@@ -1,5 +1,5 @@
 [toolchain]
-channel = "stable"
+channel = "1.93.0"
 components = ["clippy", "rustfmt"]
-targets = ["wasm32-unknown-unknown"]
+targets = ["wasm32v1-none"]
 profile = "minimal"