ci: fixe o toolchain do Rust e rode só os checks que cada workflow afeta

O CI instalava o Rust stable do dia, então cada release nova do Rust
podia quebrar PRs que não mexem em código: o 1.100 trouxe lints novos
do clippy e derrubou até atualizações só de Actions. O toolchain agora
fica fixo no rust-toolchain.toml (1.100.0), todos os workflows instalam
essa versão, e o Dependabot abre um PR próprio quando sair outra.

O filtro de caminhos também rodava tudo a qualquer mudança em
.github/workflows/. Agora só o ci.yml roda tudo; cada workflow
reutilizável liga só o próprio check, e qualquer workflow liga o
CodeQL, que analisa os Actions.

Signed-off-by: NullSablex <244216261+NullSablex@users.noreply.github.com>

Author: NullSablex

.github/dependabot.yml

@@ -42,3 +42,10 @@ updates:
     open-pull-requests-limit: 5
     commit-message:
       prefix: docs(deps)
+
+  - package-ecosystem: rust-toolchain
+    directory: /
+    schedule:
+      interval: weekly
+    commit-message:
+      prefix: build(toolchain)

.github/workflows/ci.yml

@@ -56,17 +56,20 @@ jobs:
             files=''
           fi
           printf 'Changed files:\n%s\n' "${files:-(full run)}"
-          # CI definitions affect every check, so they run everything.
-          if grep -qE '^\.github/workflows/' <<< "$files"; then all=true; fi
+          # ci.yml decides what runs, so a change to it runs everything. Each
+          # reusable workflow only triggers its own check (see the patterns
+          # below), and any workflow triggers CodeQL, which analyzes Actions.
+          if grep -qE '^\.github/workflows/ci\.yml$' <<< "$files"; then all=true; fi
           match() {
             if [ "$all" = true ] || grep -qE "$1" <<< "$files"; then echo true; else echo false; fi
           }
-          rust=$(match '^(src/|tests/|include/|build\.rs$|Cargo\.(toml|lock)$|\.cargo/|rust-toolchain\.toml$)')
+          rust=$(match '(^(src/|tests/|include/|build\.rs$|Cargo\.(toml|lock)$|\.cargo/|rust-toolchain\.toml$)|^\.github/workflows/rust\.yml$)')
+          workflows=$(match '^\.github/(workflows/|codeql/)')
           {
             echo "rust=$rust"
-            echo "docs=$(match '^(docs/|zensical\.toml$|requirements-docs\.txt$)')"
-            echo "audit=$(match '^Cargo\.lock$')"
-            if [ "$rust" = true ] || [ "$all" = true ]; then echo codeql=true; else echo codeql=false; fi
+            echo "docs=$(match '(^(docs/|zensical\.toml$|requirements-docs\.txt$)|^\.github/workflows/docs\.yml$)')"
+            echo "audit=$(match '(^Cargo\.lock$|^\.github/workflows/audit\.yml$)')"
+            if [ "$rust" = true ] || [ "$workflows" = true ] || [ "$all" = true ]; then echo codeql=true; else echo codeql=false; fi
           } | tee -a "$GITHUB_OUTPUT"
 
   rust:

.github/workflows/release.yml

@@ -34,11 +34,10 @@ jobs:
             exit 1
           fi
 
-      - name: Install Rust
-        uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # v1
-        with:
-          toolchain: stable
-          targets: i686-unknown-linux-gnu,i686-pc-windows-msvc
+      - name: Install pinned Rust toolchain
+        run: |
+          rustup toolchain install
+          rustup target add i686-unknown-linux-gnu i686-pc-windows-msvc
 
       - name: Install cross-compilation tools
         run: |

.github/workflows/rust.yml

@@ -21,12 +21,10 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
-      - name: Install Rust (stable + clippy)
-        uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # v1
-        with:
-          toolchain: stable
-          targets: i686-unknown-linux-gnu
-          components: clippy
+      - name: Install pinned Rust toolchain
+        run: |
+          rustup toolchain install
+          rustup target add i686-unknown-linux-gnu
 
       - name: Install cross-compilation tools
         run: |
@@ -51,11 +49,8 @@ jobs:
       contents: read
     steps:
       - uses: actions/checkout@v7
-      - name: Install Rust (stable + rustfmt)
-        uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # v1
-        with:
-          toolchain: stable
-          components: rustfmt
+      - name: Install pinned Rust toolchain
+        run: rustup toolchain install
       - run: cargo fmt --all -- --check
 
   coverage:
@@ -66,12 +61,11 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
-      - name: Install Rust (stable + llvm-tools)
-        uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # v1
-        with:
-          toolchain: stable
-          targets: i686-unknown-linux-gnu
-          components: llvm-tools-preview
+      - name: Install pinned Rust toolchain
+        run: |
+          rustup toolchain install
+          rustup target add i686-unknown-linux-gnu
+          rustup component add llvm-tools-preview
 
       - name: Install cross-compilation tools
         run: |

rust-toolchain.toml

@@ -0,0 +1,4 @@
+[toolchain]
+channel = "1.100.0"
+profile = "minimal"
+components = ["clippy", "rustfmt"]