add global-min-publish-age

.cargo/config.toml

@@ -0,0 +1,14 @@
+# Supply-chain cooldown for dependency resolution (unstable min-publish-age,
+# tracking issue rust-lang/cargo#17009): crate versions published less than
+# 14 days ago are excluded when the resolver runs on a nightly cargo.
+# Stable cargo ignores these tables silently, so builds from the committed
+# Cargo.lock are unaffected; run `just update` to resolve under the policy.
+# When the feature stabilizes, drop the [unstable] table and the nightly
+# resolver pin in the justfile: the policy then binds all resolution.
+# The fmt nightly (older than the feature) prints an unused-key warning
+# for these tables; harmless.
+[unstable]
+min-publish-age = true
+
+[registry]
+global-min-publish-age = "14 days"

.github/workflows/ci.yml

@@ -24,10 +24,10 @@ jobs:
           key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
 
       - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@master
+        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1
         with:
           toolchain: nightly-2026-01-01
-          components: clippy, rustfmt
+          components: rustfmt
 
       - name: Install protoc
         run: sudo provisioning/protoc.sh
@@ -41,7 +41,7 @@ jobs:
         run: echo "$HOME/.cargo/bin" >> $GITHUB_PATH
 
       - name: Check compilation
-        run: cargo check
+        run: cargo check --locked
 
       - name: Check formatting
         run: just fmt-check

.github/workflows/release.yml

@@ -207,7 +207,7 @@ jobs:
             ${{ runner.os }}-cargo-build-
 
       - name: Build binary (Darwin)
-        run: cargo build --release --target ${{ matrix.target }} --bin ${{ matrix.name }}
+        run: cargo build --locked --release --target ${{ matrix.target }} --bin ${{ matrix.name }}
 
       - name: Package binary (Darwin)
         run: |

.github/workflows/security-audit.yml

@@ -22,4 +22,21 @@ jobs:
       - uses: taiki-e/install-action@43aecc8d72668fbcfe75c31400bc4f890f1c5853 # v2.83.2
         with:
           tool: cargo-audit
-      - run: cargo audit
+      - run: cargo audit
+      # Stable cargo ignores the publish-age policy, so the lockfile can pin
+      # too-young crates (or deliberately via `just update-allow`); surface them.
+      - name: Check lockfile against the publish-age cooldown
+        continue-on-error: true
+        run: |
+          rustup toolchain install nightly-2026-06-21 --profile minimal
+          if ! cargo +nightly-2026-06-21 update --dry-run -Z min-publish-age > cooldown.txt 2>&1; then
+            msg=$(head -20 cooldown.txt | sed ':a;N;$!ba;s/\n/%0A/g')  # %0A = newline in annotations
+            echo "::warning title=Publish-age cooldown probe failed::$msg"
+            exit 0
+          fi
+          hits=$(grep -E "Downgrading|is too new" cooldown.txt || true)
+          if [ -n "$hits" ]; then
+            count=$(echo "$hits" | wc -l)
+            msg=$(echo "$hits" | head -20 | sed ':a;N;$!ba;s/\n/%0A/g')
+            echo "::warning title=Lockfile pins $count crate(s) younger than the publish-age cooldown::$msg"
+          fi