From 43b327b474324730b20e8feac74cee5a72e45bb8 Mon Sep 17 00:00:00 2001
From: James Booth <jms.p.booth@icloud.com>
Date: Thu, 8 Oct 2026 12:58:33 -0400
Subject: [PATCH] fix: address FOSS hardening review findings

---
 .github/ISSUE_TEMPLATE/config.yml |  1 -
 .github/workflows/ci.yml          |  7 +++--
 .github/workflows/release-plz.yml | 47 +++++++++++++++++++++++++------
 deny.toml                         |  1 +
 4 files changed, 44 insertions(+), 12 deletions(-)

diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml
index 379d6e6..b3362dd 100644
--- a/.github/ISSUE_TEMPLATE/config.yml
+++ b/.github/ISSUE_TEMPLATE/config.yml
@@ -1,5 +1,4 @@
 blank_issues_enabled: false
-
 contact_links:
   - name: Security vulnerability
     url: https://github.com/LATTIX-IO/fhekit/security/advisories/new
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index dc64ce3..590c368 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -19,18 +19,19 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 0
           persist-credentials: false
 
       - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@89b12181fb390509a0842a86cc55eeb8eb928c1d
+        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # stable
         with:
+          toolchain: stable
           components: rustfmt, clippy
 
       - name: Cache Cargo
-        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6
+        uses: Swatinem/rust-cache@258712b0b7b1ddf8bddc9fc3b0faca682b2736c3 # v2.9.2
 
       - name: Format
         run: cargo fmt --all -- --check
diff --git a/.github/workflows/release-plz.yml b/.github/workflows/release-plz.yml
index 2b673db..d2d2043 100644
--- a/.github/workflows/release-plz.yml
+++ b/.github/workflows/release-plz.yml
@@ -1,40 +1,71 @@
 name: Release-plz
 
 on:
+  push:
+    branches:
+      - main
   workflow_dispatch:
 
 permissions:
   contents: read
 
 jobs:
+  release-plz-release:
+    name: Release-plz release
+    runs-on: ubuntu-latest
+    if: ${{ github.repository_owner == 'LATTIX-IO' && github.ref == 'refs/heads/main' }}
+
+    permissions:
+      contents: write
+      pull-requests: read
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # stable
+        with:
+          toolchain: stable
+
+      - name: Publish eligible releases
+        uses: release-plz/action@d529f731ae3e89610ada96eda34e5c6ba3b12214 # v0.5
+        with:
+          command: release
+        env:
+          GITHUB_TOKEN: ${{ secrets.RELEASE_PLZ_TOKEN }}
+          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
+
   release-plz-pr:
     name: Release-plz PR
     runs-on: ubuntu-latest
-
-    if: >-
-      ${{ github.repository_owner == 'LATTIX-IO' &&
-          github.ref == 'refs/heads/main' }}
+    if: ${{ github.repository_owner == 'LATTIX-IO' && github.ref == 'refs/heads/main' }}
 
     permissions:
       contents: write
       pull-requests: write
 
     concurrency:
-      group: release-plz-${{ github.ref }}
+      group: release-plz-pr-${{ github.ref }}
       cancel-in-progress: false
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 0
           persist-credentials: false
 
       - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@89b12181fb390509a0842a86cc55eeb8eb928c1d
+        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # stable
+        with:
+          toolchain: stable
 
       - name: Prepare release PR
-        uses: release-plz/action@18641b6c63063cc5ff8786ebf69cd57e8541bae1
+        uses: release-plz/action@d529f731ae3e89610ada96eda34e5c6ba3b12214 # v0.5
         with:
           command: release-pr
         env:
diff --git a/deny.toml b/deny.toml
index e0be11d..df468c5 100644
--- a/deny.toml
+++ b/deny.toml
@@ -28,4 +28,5 @@ highlight = "all"
 [sources]
 unknown-registry = "deny"
 unknown-git = "deny"
+allow-registry = ["https://github.com/rust-lang/crates.io-index"]
 allow-git = []