Make Rust CI workflows zizmor compliant (#38)

Pin every action reference in the Rust CI additions to a full commit
SHA, as required by the repository's zizmor blanket policy:

* dtolnay/rust-toolchain -> ab40b01 (1.91.1) and 4cda84d (stable)
* actions/checkout -> 9c091bb (v7.0.0), matching the rest of the repo

dtolnay/rust-toolchain derives the installed toolchain from the action
ref, so hash-pinning it requires an explicit `toolchain:` input; add one
wherever it was not already present.

Also switch the x64 "Install LLVM for bindgen" step from `shell: cmd` to
`shell: pwsh`, mirroring the existing ARM64 step, to resolve the
remaining zizmor misfeature finding.

Author: fedonman

.github/setup-rust-windows/action.yml

@@ -11,20 +11,21 @@ inputs:
 runs:
   using: composite
   steps:
-    - uses: dtolnay/rust-toolchain@1.91.1
+    - uses: dtolnay/rust-toolchain@ab40b01f54fe82bdf65693ea090a1e4942c136e7 # 1.91.1
       with:
+        toolchain: 1.91.1
         targets: i686-pc-windows-msvc,x86_64-pc-windows-msvc,aarch64-pc-windows-msvc
     # LIBCLANG_PATH must be set explicitly so the vcxproj uses the LLVM we
     # install here rather than the VS-bundled LLVM whose clang headers have
     # AVX intrinsic bugs.  The values are hardcoded literals (no attacker-
     # controlled input), so the GITHUB_ENV writes are safe.
     - name: Install LLVM for bindgen
       if: inputs.arch != 'arm64'
-      shell: cmd
+      shell: pwsh
       run: | # zizmor: ignore[github-env]
         choco install llvm --allow-downgrade --no-progress --version 21.1.0
-        if not exist "C:\Program Files\LLVM\bin\libclang.dll" exit /b 1
-        echo LIBCLANG_PATH=C:\Program Files\LLVM\bin>> "%GITHUB_ENV%"
+        if (!(Test-Path 'C:\Program Files\LLVM\bin\libclang.dll')) { exit 1 }
+        echo "LIBCLANG_PATH=C:\Program Files\LLVM\bin" >> $env:GITHUB_ENV
     # Chocolatey's LLVM package only ships x64 binaries, which an ARM64-native
     # cargo process cannot load.  Install the official ARM64 build directly.
     - name: Install LLVM for bindgen (ARM64)

.github/workflows/build.yml

@@ -353,8 +353,9 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
-      - uses: dtolnay/rust-toolchain@1.91.1
+      - uses: dtolnay/rust-toolchain@ab40b01f54fe82bdf65693ea090a1e4942c136e7 # 1.91.1
         with:
+          toolchain: 1.91.1
           targets: ${{ matrix.arch }}-linux-android
       - name: Build and test
         run: JAVA_HOME="${JAVA_HOME_21_X64:-$JAVA_HOME_21_arm64}" python3 Platforms/Android ci --fast-ci ${{ matrix.arch }}-linux-android
@@ -369,8 +370,9 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
-      - uses: dtolnay/rust-toolchain@1.91.1
+      - uses: dtolnay/rust-toolchain@ab40b01f54fe82bdf65693ea090a1e4942c136e7 # 1.91.1
         with:
+          toolchain: 1.91.1
           targets: aarch64-apple-ios-sim
       # GitHub recommends explicitly selecting the desired Xcode version:
       # https://github.com/actions/runner-images/issues/12541#issuecomment-3083850140

.github/workflows/cargo.yml

@@ -15,10 +15,10 @@ jobs:
     timeout-minutes: 15
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
         with:
           toolchain: stable
       - run: ./configure

.github/workflows/reusable-wasi.yml

@@ -47,8 +47,9 @@ jobs:
       uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
       with:
         python-version: '3.x'
-    - uses: dtolnay/rust-toolchain@1.91.1
+    - uses: dtolnay/rust-toolchain@ab40b01f54fe82bdf65693ea090a1e4942c136e7 # 1.91.1
       with:
+        toolchain: 1.91.1
         targets: wasm32-wasip1
     - name: "Runner image version"
       run: echo "IMAGE_OS_VERSION=${ImageOS}-${ImageVersion}" >> "$GITHUB_ENV"