[MotherSphere]

What changed

.github/workflows/ci.yml only. release-please.yml carries the same toolchain pin and is handled separately.

Read-only token. The workflow now declares permissions: contents: read at the top level, so the format, clippy, test, Windows version-resource and MSRV jobs, and the third-party actions they run, get a read-only GITHUB_TOKEN instead of the repository default. The Advisories job alone adds checks: write, which rustsec/audit-check documents as the permission it needs to report the advisories as a check run. It keeps contents: read for the checkout, since a job-level block replaces the top-level one.

dtolnay/rust-toolchain re-pinned. The old pin 4cda84d5 was a 2026-07-16 head of the action's stable branch. That branch is rebased onto every master commit, so the SHA is no longer reachable from any branch (compare against stable shows it diverged, 14 ahead and 1 behind), Dependabot cannot move it because # stable branch is not a version, and it predates upstream dtolnay/rust-toolchain#187 ("Safely handle action inputs"). Both uses now pin e2a55d2f, the merge commit of #187 and the current head of master, with the comment # master, 2026-10-09. This is the same pin and the same reasoning as templates/sign-and-publish-caller.yml and the CI of Project-Colony-Resources. A master pin has no default toolchain, so the check job now passes toolchain: stable; the MSRV job already passes its own toolchain. Like the template, this pin is bumped by hand.

Swatinem/rust-cache re-pinned. The old pin f0d9c388 was commented # v2 but was the head of master, 5 commits past the v2 release. It now pins 6323deb1, the commit both v2 and v2.9.2 point to, commented # v2.9.2, so the Dependabot github-actions entry can bump the SHA and the version comment together.

Verification

• gh api repos/dtolnay/rust-toolchain/branches/master points at e2a55d2f; its action.yml requires the toolchain input, which both steps now set.
• gh api repos/Swatinem/rust-cache/git/ref/tags/v2.9.2 is an annotated tag whose object is commit 6323deb1; tag v2 resolves to the same commit.
• The workflow parses as YAML, and the parsed permissions are {contents: read} at the top and {contents: read, checks: write} on the Advisories job.
• Every uses: line in .github/workflows/ is pinned to a 40-character SHA with a trailing comment.
• CI on this pull request runs every job with the new token and pins.