ci: update the Rust toolchain weekly

.github/pinact.yaml

@@ -1,8 +1,7 @@
-# yaml-language-server: $schema=https://raw.githubusercontent.com/suzuki-shunsuke/pinact/main/json-schema/pinact.json
 version: 3
-
-ignore_actions:
-  # ci-workflows publishes no tags, so its actions are pinned to a commit of
-  # `main` and carry no release comment for pinact to verify.
-  - name: argumentcomputer/ci-workflows/.*
-    ref: "[0-9a-f]{40}"
+rules:
+  # Branch refs that must keep tracking their branch: there is no stable tag
+  # to pin to. The shared ci-workflows actions are consumed from `main`.
+  - ignore: true
+    conditions:
+      - expr: ActionName matches "^argumentcomputer/ci-workflows/"

.github/workflows/ci.yml

@@ -40,7 +40,7 @@ jobs:
       # actionlint, shellcheck, pinact and zizmor over this repo's workflows.
       # Runs before the toolchain setup so a workflow problem fails fast.
       - name: Lint workflows
-        uses: argumentcomputer/ci-workflows/.github/actions/lint-workflows@a3a7b1b8f081503e6bf26341a3c5f759df96497a # main
+        uses: argumentcomputer/ci-workflows/.github/actions/lint-workflows@main
       - uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2.0.0
       - name: Check Rustfmt code style
         run: cargo fmt --all --check

.github/workflows/update-rust.yml

@@ -0,0 +1,35 @@
+name: Update Rust toolchain
+
+on:
+  schedule:
+    # Weekly on Monday at midnight
+    - cron: "0 0 * * 1"
+      timezone: America/New_York
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  update:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      # `update-flake` below rewrites the fenix hash and runs `nix flake update`
+      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
+        with:
+          github_access_token: ${{ github.token }}
+
+      # Moves `rust-toolchain.toml` to the latest stable release, with the
+      # fenix `sha256` and the fenix and crane inputs in `flake.nix`, and
+      # opens a PR on `update/rust-<version>`. nixpkgs follows fenix here, so
+      # it moves in the same PR. The PR is opened with `GITHUB_TOKEN`, so a
+      # maintainer closes and reopens it to run CI.
+      - uses: argumentcomputer/ci-workflows/.github/actions/rust-version@main
+        with:
+          update-flake: 'true'
+          pr: 'true'

.github/zizmor.yml

@@ -0,0 +1,7 @@
+rules:
+  unpinned-uses:
+    config:
+      policies:
+        # Branch-tracking ref allowed by .github/pinact.yaml
+        "argumentcomputer/ci-workflows/*": ref-pin
+        "*": hash-pin