[rapp992]

What changed

The six dtolnay/rust-toolchain SHA pins in ci.yml, release.yml and security-nightly.yml move from 7e38f4b to e2a55d2, which is what the v1 tag (and master) now points to.

Why. Upstream moved v1 to merge dtolnay/rust-toolchain#187, a security hardening of the action itself ("Safely handle action inputs"):

• multi-line-safe GITHUB_OUTPUT writes, using a delimiter that adapts to the input;
• rustup flags built as an argv array under set -f, instead of string-concatenated command lines.

zizmor's online ref-version-mismatch audit now fails the Docs & paths lint step on every PR. Our pins are commented # v1 but point at the old head. This first showed up on #954.

e2a55d2 is a descendant of the old pin (git merge-base --is-ancestor holds), and the diff touches only action.yml (+29/−20). I read the whole diff.

Verification

• make lint-ci passes locally: actionlint, plus zizmor (offline) with no findings.
• The online zizmor audit only runs in CI, so this PR's Docs & paths job is the proof.

Gates skipped: the full make verify was not run. This is a workflow-pin-only change, and CI runs everything.

Reviews

Claude: none. This is a mechanical pin update, and I reviewed the upstream diff above. Codex: absent.

Capability spec

• No capability spec covers this area.

Security surface

• Names the surface: CI workflows are on it. The change adopts an upstream injection-hardening fix in a pinned action.

Invariants touched: none.

Escalations

• relay(capability): bound or document the wider pre-send cancel window under concurrent fan-out #954 carries the same change so it can go green. It becomes a no-op once this merges.

---

Must be merged by a human — nothing here merges autonomously.

🤖 Generated with Claude Code

https://claude.ai/code/session_017phewNxcFMxpU3ntX2TKek

---

Generated by Claude Code