cargo update, tighten GH workflows

`zizmor` was quite helpful for static analysis of them.

Author: kayabaNerve

.github/actions/bitcoin/action.yml

@@ -20,6 +20,8 @@ runs:
     - name: Download and Extract the Bitcoin Daemon
       if: steps.cache-bitcoind.outputs.cache-hit != 'true'
       shell: bash
+      env:
+        VERSION: ${{ inputs.version }}
       run: |
         OS=${{ runner.os }}
         ARCH=${{ runner.arch }}
@@ -44,16 +46,16 @@ runs:
           EXT="zip"
         fi
 
-        FILE=bitcoin-${{ inputs.version }}-$ARCH$OS.$EXT
+        FILE=bitcoin-${ VERSION }-$ARCH$OS.$EXT
 
-        curl -L https://bitcoincore.org/bin/bitcoin-core-${{ inputs.version }}/$FILE -o $FILE
+        curl -L https://bitcoincore.org/bin/bitcoin-core-${ VERSION }/$FILE -o $FILE
 
         if [ "${{ runner.os }}" = "Windows" ]; then
           unzip $FILE
           mv $(find . -name "bitcoind*") .
         else
           tar -xf $FILE
-          cd bitcoin-${{ inputs.version }}
+          cd bitcoin-${ VERSION }
           if [ "${{ runner.os }}" = "macOS" ]; then
             sudo mv bin/* /usr/local/bin/
           else

.github/actions/docker/action.yml

@@ -16,7 +16,7 @@ runs:
         sudo apt install -y uidmap
 
     - name: Install rootless Docker (Linux)
-      uses: docker/setup-docker-action@1a6edb0ba9ac496f6850236981f15d8f9a82254d # 5.0.0
+      uses: docker/setup-docker-action@b2189fbf2a6592b51fee7cdd93ee2bfaeba733db # 5.1.0
       if: runner.os == 'Linux'
       with:
         rootless: true
@@ -47,7 +47,7 @@ runs:
         fi
 
     - name: Install Docker (macOS)
-      uses: docker/setup-docker-action@1a6edb0ba9ac496f6850236981f15d8f9a82254d # 5.0.0
+      uses: docker/setup-docker-action@b2189fbf2a6592b51fee7cdd93ee2bfaeba733db # 5.1.0
       if: runner.os == 'macOS'
       env:
         # m1 chips, as seen in the GitHub CI, don't support nested hardware virtualization.

.github/actions/monero/action.yml

@@ -20,6 +20,8 @@ runs:
     - name: Download the Monero Daemon
       if: steps.cache-monerod.outputs.cache-hit != 'true'
       shell: bash
+      env:
+        VERSION: ${{ inputs.version }}
       run: |
         OS=${{ runner.os }}
         ARCH=${{ runner.arch }}
@@ -38,12 +40,12 @@ runs:
         if [ "$OS" = "macos" ]; then
           OS="mac"
           # If this is an ARM macOS downloading a historic version, download x64 to run via Rosetta
-          if [ $(echo "${{ inputs.version }}" | cut -d'.' -f2) -lt 18 ]; then
+          if [ $(echo "${ VERSION }" | cut -d'.' -f2) -lt 18 ]; then
             ARCH="x64"
           fi
         fi
 
-        FILE=monero-$OS-$ARCH-${{ inputs.version }}.$EXT
+        FILE=monero-$OS-$ARCH-${ VERSION }.$EXT
         mkdir monero-tmp
         cd monero-tmp
         curl -L https://downloads.getmonero.org/cli/$FILE -o $FILE

.github/actions/test-dependencies/action.yml

@@ -21,7 +21,7 @@ runs:
     - name: Install Foundry
       uses: foundry-rs/foundry-toolchain@c7450ba673e133f5ee30098b3b54f444d3a2ca2d # 1.8.0
       with:
-        version: v1.5.1
+        version: f83bad912a9dba7bf0371def1e70bb1896048356 # 1.7.0
         cache: false
 
     - name: Run a Monero Regtest Node

.github/workflows/common-tests.yml

@@ -1,4 +1,5 @@
 name: common/ Tests
+permissions: {}
 
 on:
   push:
@@ -16,13 +17,17 @@ on:
 
 jobs:
   test-common:
+    name: Test `common/` crates
+
     strategy:
       matrix:
         os: [ubuntu-latest, macos-26-intel, macos-latest]
     runs-on: ${{ matrix.os }}
 
     steps:
       - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # 6.0.0
+        with:
+          persist-credentials: false
 
       - name: Build Dependencies
         uses: ./.github/actions/build-dependencies

.github/workflows/coordinator-tests.yml

@@ -1,4 +1,5 @@
 name: Coordinator Tests
+permissions: {}
 
 on:
   push:
@@ -28,10 +29,13 @@ on:
   workflow_dispatch:
 
 jobs:
-  build:
+  test-coordinator:
+    name: e2e tests for the coordinator (`tests/coordinator`)
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # 6.0.0
+        with:
+          persist-credentials: false
 
       - name: Install Build Dependencies
         uses: ./.github/actions/build-dependencies

.github/workflows/crypto-tests.yml

@@ -1,4 +1,5 @@
 name: crypto/ Tests
+permissions: {}
 
 on:
   push:
@@ -18,13 +19,17 @@ on:
 
 jobs:
   test-crypto:
+    name: Test `crypto/` crates
+
     strategy:
       matrix:
         os: [ubuntu-latest, macos-26-intel, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
 
     steps:
       - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # 6.0.0
+        with:
+          persist-credentials: false
 
       - name: Build Dependencies
         uses: ./.github/actions/build-dependencies

.github/workflows/daily-deny.yml

@@ -1,4 +1,5 @@
 name: Daily Deny Check
+permissions: {}
 
 on:
   schedule:
@@ -10,6 +11,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # 6.0.0
+        with:
+          persist-credentials: false
 
       - name: Install `cargo deny`
         run: cargo +1.95.0 install --locked cargo-deny --version =0.19.4

.github/workflows/full-stack-tests.yml

@@ -1,4 +1,5 @@
 name: Full Stack Tests
+permissions: {}
 
 on:
   push:
@@ -10,10 +11,13 @@ on:
   workflow_dispatch:
 
 jobs:
-  build:
+  test-full-stack:
+    name: e2e tests for the full stack (`tests/full-stack`)
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # 6.0.0
+        with:
+          persist-credentials: false
 
       - name: Install Build Dependencies
         uses: ./.github/actions/build-dependencies

.github/workflows/libraries-on-redox.yml

@@ -1,4 +1,5 @@
 name: Test Libraries on Redox
+permissions: {}
 
 on:
   push:
@@ -17,10 +18,13 @@ on:
 
 jobs:
   test-redox:
+    name: Test Libraries on Redox
     runs-on: ubuntu-latest
 
     steps:
       - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # 6.0.0
+        with:
+          persist-credentials: false
 
       - name: Install QEMU
         run: sudo apt update -y && sudo apt upgrade -y && sudo apt install -y qemu-system-x86