Hash-pin all actions, apply other fixes from zizmor #2103

	name: Workspace

	on:
	pull_request:
	paths-ignore:
	- README.md
	push:
	branches: master
	paths-ignore:
	- README.md

	# Cancels CI jobs when new commits are pushed to a PR branch
	concurrency:
	group: ${{ github.workflow }}-${{ github.head_ref \|\| github.run_id }}
	cancel-in-progress: true

	permissions: {}

	jobs:
	clippy:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
	with:
	persist-credentials: false
	- uses: RustCrypto/actions/cargo-cache@master
	- uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
	with:
	toolchain: 1.85.0
	components: clippy
	- run: cargo clippy --all -- -D warnings

	rustfmt:
	runs-on: ubuntu-latest
	steps:
	- name: Checkout sources
	uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
	with:
	persist-credentials: false

	- name: Install stable toolchain
	uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
	with:
	toolchain: stable
	components: rustfmt

	- name: Run cargo fmt
	run: cargo fmt --all -- --check

	typos:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
	with:
	persist-credentials: false
	- uses: crate-ci/typos@02ea592e44b3a53c302f697cddca7641cd051c3d # v1.45.0

Provide feedback