ci: unbreak zizmor and cargo-deny, and stop upstream ref moves from re-breaking them

[K-dash]

Summary

Every open Renovate PR (#145–#154) has been failing CI, and so has main itself since #143. Neither is a Renovate problem: nothing in this repository changed. Two upstream refs moved, and the version comments next to our pinned SHAs stopped matching them.

zizmor was never the variable. zizmorcore/zizmor-action@192e21d (v0.5.7) resolves version: latest through support/versions inside that pinned action commit, which maps latest to a fixed ghcr.io/zizmorcore/zizmor image digest — 1.26.1. Pinning the action SHA already pins the binary, so the audit set has been constant since #121 introduced it on 07-11. What changed was the online audits' input:

When	Upstream event	Effect on CI
07-11	#121 pins zizmor-action v0.5.7 (= zizmor 1.26.1)	green
07-16 16:35	dtolnay force-pushes stable / master	our pinned SHAs become unreachable from any ref
07-17 19:12	first failure (#146)	3 error[impostor-commit] (high) + 4 warning[ref-version-mismatch], all on dtolnay/rust-toolchain
07-20 15:10	actions/checkout v7.0.1 released, moving the v7 tag	the # v7 comments now name a ref that no longer resolves to the pinned v7.0.0 SHA
07-21 onward	symptom changes to 8 medium	all eight actions/checkout pins
07-25	#144 bumps the rust-toolchain digests	incidentally cures the first cause; the eight checkout findings remain

A third, independent failure hit #145 / #150 / #151: cargo-deny's bans check, because the ecosystem-wide syn 2 → 3 migration puts two majors in the graph at once.

This PR fixes both, and removes the class of breakage rather than just today's instance.

Changes

Stop naming moving refs in version comments. A comment like # v7 only passes while the pinned SHA happens to be the current tip of a tag that upstream keeps moving — a red window between every upstream release and Renovate's next run (this repo is on schedule: every weekend, so up to a week). Exact-version comments name an immutable tag instead.

• actions/checkout ×8: bumped to 3d3c42e and the comment changed # v7 → # v7.0.1.
• actions/upload-artifact ×3 and actions/download-artifact ×1: SHA unchanged, comment only, # v7 → # v7.0.1 and # v8 → # v8.0.1.
• Swatinem/rust-cache: e18b497 # v2 → c193711 # v2.9.1. The pinned SHA had no exact tag pointing at it — only the moving v2. The two commits differ by CHANGELOG.md (+4 −0) and nothing else, so this is inert.

dtolnay/rust-toolchain ×4: suppress two structurally-false-positive audits. This action publishes via force-pushed branches, not tags, so there is no immutable ref to name. Both audits fire on a pin that is not actually compromised: ref-version-mismatch because stable no longer resolves to it, impostor-commit because the old SHA is no longer reachable from any ref. That is normal for this publisher, not an attack signal. Each of the four pins now carries an inline # zizmor: ignore[ref-version-mismatch,impostor-commit], with the reasoning written out at the first occurrence in ci.yml and referenced from the other sites.

Rejected alternative: pinning to the v1 tag. v1 was last moved 2025-08-23 while master has moved five times since; its toolchain input is required: true, so the three # stable sites would each need an added with: toolchain: stable; and its action.yml is missing RUSTUP_PERMIT_COPY_RENAME: 1. Replacing the action with direct rustup calls (which zizmor's superfluous-actions suggests at info severity, suppressed under this repo's regular persona) is a larger change to the release path and belongs in its own PR.

deny.toml: tolerate the syn 2/3 split. Proc-macro crates cross to syn 3 one release at a time — clap_derive, serde_derive and thiserror-impl already have; tokio-macros, tracing-attributes and the icu4x derives have not — so a two-major graph is unavoidable for months and merging the three PRs together does not resolve it. Added a documented skip following the existing bitflags@1.3.2 precedent, rather than downgrading multiple-versions to "warn" (which that file's own comment rejects).

Two deliberate details: the skip targets syn@2, the older side, so it becomes a no-op and can be deleted as the migration completes — skipping syn@3 would leave it needed permanently. And it is a range, not an exact pin like bitflags@1.3.2, because syn 2.x keeps shipping patches while the migration runs; an exact pin would go stale on the next Renovate lockfile bump.

Verification

Run with the exact versions CI uses: zizmor 1.26.1 (matching the 🌈 zizmor v1.26.1 banner in the failing logs) and cargo-deny 0.19.8 (ENV deny_version in cargo-deny-action v2.0.20's Dockerfile) plus 0.20.2 (bundled by v2.1.1, which #146 upgrades to). zizmor was run with a token so the online audits actually execute — without one they are silently skipped and the run is a false green.

Before the fix, the reproduction matched CI exactly: 24 findings (16 suppressed, 8 unsafe fixes): 8 medium.

Each open PR was merged onto this branch individually and both checks run:

PR	cargo-deny 0.19.8 / 0.20.2	zizmor
#145 clap	ok / ok	no findings
#146 cargo-deny-action	ok / ok	no findings
#147 tokio	ok / ok	no findings
#148 zizmor-action	ok / ok	no findings
#149 anyhow	ok / ok	no findings
#150 serde	ok / ok	no findings
#151 thiserror	ok / ok	no findings
#152 checkout digest	—	conflicts; superseded, see below
#153 libc	ok / ok	no findings
#154 serde_json	ok / ok	no findings

For the rust-toolchain ignores, passing today proves nothing — today's pins match the branch tips. So the 07-17 failure was reconstructed by reverting the four pins to the stale SHAs and run both ways:

• with the ignores: No findings to report. (3 ignored, 16 suppressed)
• without them: 23 findings (16 suppressed): 4 medium, 3 high

One honest note on that mechanism: with only impostor-commit listed, the four ref-version-mismatch findings also stop firing — appending the directive changes how the trailing comment parses, so that audit no longer evaluates rather than being explicitly ignored. ref-version-mismatch is kept in the list so that a future zizmor which parses the comment correctly still finds an explicit entry.

Follow-ups

• chore(deps): update actions/checkout digest to 3d3c42e - autoclosed #152 should be closed, not merged. It bumps actions/checkout to the same 3d3c42e this PR uses (verified identical), but conflicts because this PR also rewrites the comment. Renovate is unlikely to auto-close it, since # v7.0.1 reads as a different dependency version than the v7 digest it was tracking.
• Until one of chore(deps): update rust crate clap to v4.6.4 #145 / chore(deps): update rust crate serde to v1.0.229 #150 / chore(deps): update rust crate thiserror to v2.0.19 #151 lands, cargo-deny emits warning[unnecessary-skip]: skip 'syn = =2' applied to a crate with only one version. Exit code 0, non-blocking — expected, not a regression.
• The existing red checks on every Renovate PR stay red until each is rebased onto the fixed main.