add global-min-publish-age (#492)

Two conflicts resolved against the v0.10.0 base: security-audit.yml
adopts the cooldown step onto that release's audit workflow, which
still uses actions-rs/audit-check, and Cargo.lock is reconciled onto
v0.10.0's dependency tree rather than main's. Dropping the pinned
reqwest-eventsource collapses a duplicate copy of the crate that
v0.10.0 carried at both 0.5.0 and 0.6.0.

Co-authored-by: Manuel Iñaki Bilbao <manuel.bilbao@lambdaclass.com>
(cherry picked from commit 0d3eb68)

Author: JasonVranek

.cargo/config.toml

@@ -0,0 +1,14 @@
+# Supply-chain cooldown for dependency resolution (unstable min-publish-age,
+# tracking issue rust-lang/cargo#17009): crate versions published less than
+# 14 days ago are excluded when the resolver runs on a nightly cargo.
+# Stable cargo ignores these tables silently, so builds from the committed
+# Cargo.lock are unaffected; run `just update` to resolve under the policy.
+# When the feature stabilizes, drop the [unstable] table and the nightly
+# resolver pin in the justfile: the policy then binds all resolution.
+# The fmt nightly (older than the feature) prints an unused-key warning
+# for these tables; harmless.
+[unstable]
+min-publish-age = true
+
+[registry]
+global-min-publish-age = "14 days"

.github/workflows/ci.yml

@@ -24,10 +24,10 @@ jobs:
           key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
 
       - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@master
+        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1
         with:
           toolchain: nightly-2026-01-01
-          components: clippy, rustfmt
+          components: rustfmt
 
       - name: Install protoc
         run: sudo provisioning/protoc.sh
@@ -41,7 +41,7 @@ jobs:
         run: echo "$HOME/.cargo/bin" >> $GITHUB_PATH
 
       - name: Check compilation
-        run: cargo check
+        run: cargo check --locked
 
       - name: Check formatting
         run: just fmt-check

.github/workflows/release.yml

@@ -207,7 +207,7 @@ jobs:
             ${{ runner.os }}-cargo-build-
 
       - name: Build binary (Darwin)
-        run: cargo build --release --target ${{ matrix.target }} --bin ${{ matrix.name }}
+        run: cargo build --locked --release --target ${{ matrix.target }} --bin ${{ matrix.name }}
 
       - name: Package binary (Darwin)
         run: |

.github/workflows/security-audit.yml

@@ -21,4 +21,23 @@ jobs:
       - uses: actions/checkout@v6
       - uses: actions-rs/audit-check@v1.2.0
         with:
-          token: ${{ secrets.GITHUB_TOKEN }}
+          token: ${{ secrets.GITHUB_TOKEN }}
+      # Stable cargo ignores the publish-age policy, so the lockfile can pin
+      # too-young crates (or deliberately via `just update-allow`); surface them.
+      - name: Check lockfile against the publish-age cooldown
+        run: |
+          if ! rustup toolchain install nightly-2026-06-21 --profile minimal; then
+            echo "::warning title=Publish-age cooldown check skipped::toolchain install failed"
+            exit 0
+          fi
+          if ! cargo +nightly-2026-06-21 update --dry-run -Z min-publish-age > cooldown.txt 2>&1; then
+            msg=$(head -20 cooldown.txt | sed ':a;N;$!ba;s/\n/%0A/g')  # %0A = newline in annotations
+            echo "::warning title=Publish-age cooldown probe failed::$msg"
+            exit 0
+          fi
+          hits=$(grep -E "Downgrading|is too new" cooldown.txt || true)
+          if [ -n "$hits" ]; then
+            count=$(echo "$hits" | wc -l)
+            msg=$(echo "$hits" | head -20 | sed ':a;N;$!ba;s/\n/%0A/g')
+            echo "::warning title=Lockfile pins $count crate(s) younger than the publish-age cooldown::$msg"
+          fi