Merge remote-tracking branch 'origin/main' into HEAD

# Conflicts:
#	Cargo.lock

.github/workflows/actions.lock

@@ -1,34 +0,0 @@
-# This file is machine-generated by `gh actions-lock`.
-# Do not edit by hand; run `gh actions-lock` to update.
-# Docs: https://gh.io/actions-lockfile
-version: 'v0.0.3'
-workflows:
-    '.github/workflows/ast-grep.yml': []
-    '.github/workflows/ci.yml': []
-    '.github/workflows/freebsd.yml': []
-    '.github/workflows/house-rules.yml': []
-    '.github/workflows/lockfile.yml':
-        - 'actions/checkout@v7.0.1'
-        - 'step-security/harden-runner@v2.22.4'
-    '.github/workflows/nix.yml':
-        - 'actions/checkout@v7.0.1'
-        - 'step-security/harden-runner@v2.22.4'
-    '.github/workflows/packaging-lint.yml':
-        - 'actions/checkout@v7.0.1'
-        - 'step-security/harden-runner@v2.22.4'
-    '.github/workflows/release.yml':
-        - 'actions/checkout@v7.0.1'
-        - 'step-security/harden-runner@v2.22.4'
-    '.github/workflows/sonarcloud.yml': []
-    '.github/workflows/windows-arm64.yml': []
-dependencies:
-    'actions/checkout@v7.0.1':
-        ref: 'v7.0.1'
-        commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
-        owner_id: 44036562
-        repo_id: 197814629
-    'step-security/harden-runner@v2.22.4':
-        ref: 'v2.22.4'
-        commit: 'sha1-1d88384fd173af6ecb012dfd0264a306b711241a'
-        owner_id: 88700172
-        repo_id: 422287306

.github/workflows/lockfile.yml

@@ -1,34 +0,0 @@
-name: Lockfile
-
-# Fails when .github/workflows/actions.lock is out of sync with the workflows, or when a locked pin
-# no longer verifies upstream, so a moved tag cannot slip a different commit into a run.
-# Docs: https://gh.io/actions-lockfile
-on:
-  pull_request:
-  push:
-    branches: [main]
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-env:
-  GH_TOKEN: ${{ github.token }}
-
-jobs:
-  lockfile:
-    name: Lockfile is in sync
-    runs-on: ubuntu-24.04
-    timeout-minutes: 10
-    steps:
-      - name: Harden runner
-        uses: step-security/harden-runner@v2.22.4
-        with:
-          egress-policy: audit
-      - uses: actions/checkout@v7.0.1
-        with:
-          persist-credentials: false
-      - name: Install gh-actions-lock
-        run: gh extension install github/gh-actions-lock --pin v0.4.1
-      - name: Verify the lockfile
-        run: gh actions-lock --verify

.github/workflows/nix.yml

@@ -28,10 +28,10 @@ jobs:
     timeout-minutes: 5
     steps:
       - name: Harden runner
-        uses: step-security/harden-runner@v2.22.4
+        uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
         with:
           egress-policy: audit
-      - uses: actions/checkout@v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Git dependencies come from storytold
         run: |
           set -euo pipefail

.github/workflows/packaging-lint.yml

@@ -28,10 +28,10 @@ jobs:
     runs-on: windows-latest
     steps:
       - name: Harden runner
-        uses: step-security/harden-runner@v2.22.4
+        uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
         with:
           egress-policy: audit
-      - uses: actions/checkout@v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Install the pinned packaging toolchain

.github/workflows/release.yml

@@ -35,10 +35,10 @@ jobs:
       contents: read
     steps:
       - name: Harden runner
-        uses: step-security/harden-runner@v2.22.4
+        uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
         with:
           egress-policy: audit
-      - uses: actions/checkout@v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Git dependencies come from storytold
         run: |
           set -euo pipefail

sonar-project.properties

@@ -1,11 +1,2 @@
 sonar.projectKey=storytold_cadcraft
 sonar.organization=storytold
-
-# githubactions:S7637 asks for every action to be pinned to a commit SHA. A workflow covered by
-# .github/workflows/actions.lock runs the commit the lockfile records, so its tag refs are pinned
-# and the lockfile covers the actions those actions use too. Sonar does not read lockfiles yet, so
-# the rule flags the tag refs anyway:
-# https://community.sonarsource.com/t/githubactions-s7637-false-positives-for-actions-pinned-through-native-actions-lock/190814
-sonar.issue.ignore.multicriteria=gha-lockfile
-sonar.issue.ignore.multicriteria.gha-lockfile.ruleKey=githubactions:S7637
-sonar.issue.ignore.multicriteria.gha-lockfile.resourceKey=.github/workflows/**

xtask/src/stats.rs

@@ -141,7 +141,6 @@ mod tests {
     fn fresh_dir(tag: &str) -> std::path::PathBuf {
         let nanos = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).map_or(0, |d| d.as_nanos());
         let p = std::env::temp_dir().join(format!("cadcraft-{tag}-{}-{nanos}", std::process::id()));
-        #[cfg_attr(not(unix), allow(unused_mut))]
         let mut b = std::fs::DirBuilder::new();
         #[cfg(unix)]
         std::os::unix::fs::DirBuilderExt::mode(&mut b, 0o700);