From 647e906d4772864af3fdc65777063c8bcf1f7e43 Mon Sep 17 00:00:00 2001
From: Diogo Mendes Matsubara <diogo.matsubara@zettascale.tech>
Date: Fri, 21 Aug 2026 17:17:11 +0200
Subject: [PATCH 1/4] chore: run recreate cargo.lock less often

- use nightly so we can use the cooldown feature for recently published
  crates (-Zmin-publish-age) set to 14 days.
- change the schedule to run every 14 days.
---
 .github/workflows/recreate-lockfile.yml | 26 ++++++++++++++-----------
 1 file changed, 15 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/recreate-lockfile.yml b/.github/workflows/recreate-lockfile.yml
index e74ac51..3841bc3 100644
--- a/.github/workflows/recreate-lockfile.yml
+++ b/.github/workflows/recreate-lockfile.yml
@@ -2,7 +2,7 @@ name: Recreate Cargo lockfile
 
 on:
   schedule:
-    - cron: "0 0 * * *" # At the end of every day
+    - cron: "0 0 */14 * *" # Run fortnightly at 00:00 UTC
   workflow_dispatch:
     inputs:
       branch:
@@ -44,16 +44,20 @@ jobs:
         run: |
           set -euo pipefail
 
-          if [[ -n "$TOOLCHAIN_INPUT" ]]; then
-            RUST_TOOLCHAIN="$TOOLCHAIN_INPUT"
-          else
-            RUST_TOOLCHAIN="$(yq -r '.toolchain.channel // ""' rust-toolchain.toml)"
-          fi
+          # NOTE: override to nightly toolchain so we can use cargo's -Zmin-publish-age
+          # to avoid pulling in recently published dependencies possibly mitigating supply chain attacks.
+          # This feature will be available in 1.100.0 scheduled for release in September 2026.
+          RUST_TOOLCHAIN="nightly"
+          #if [[ -n "$TOOLCHAIN_INPUT" ]]; then
+          #  RUST_TOOLCHAIN="$TOOLCHAIN_INPUT"
+          #else
+          #  RUST_TOOLCHAIN="$(yq -r '.toolchain.channel // ""' rust-toolchain.toml)"
+          #fi
 
-          if [[ ! "$RUST_TOOLCHAIN" =~ ^[A-Za-z0-9][A-Za-z0-9._+@-]*$ ]]; then
-            echo "Invalid Rust toolchain" >&2
-            exit 1
-          fi
+          #if [[ ! "$RUST_TOOLCHAIN" =~ ^[A-Za-z0-9][A-Za-z0-9._+@-]*$ ]]; then
+          #  echo "Invalid Rust toolchain" >&2
+          #  exit 1
+          #fi
 
           printf 'RUST_TOOLCHAIN=%s\n' "$RUST_TOOLCHAIN" >> "$GITHUB_ENV"
 
@@ -70,7 +74,7 @@ jobs:
       - name: Recreate Cargo.lock
         run: |
           rm -f Cargo.lock
-          cargo "+${RUST_TOOLCHAIN}" update --manifest-path Cargo.toml
+          cargo "+${RUST_TOOLCHAIN}" -Zmin-publish-age --config registry.global-min-publish-age='"14 days"' update --manifest-path Cargo.toml
 
       - name: Create/Update a pull request if the lockfile changed
         id: cpr

From 7e1274c61bfa534a948edbe099d3501ea8dae897 Mon Sep 17 00:00:00 2001
From: Diogo Mendes Matsubara <diogo.matsubara@zettascale.tech>
Date: Fri, 21 Aug 2026 17:34:43 +0200
Subject: [PATCH 2/4] chore: pin actions to commit

---
 .github/workflows/recreate-lockfile.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/recreate-lockfile.yml b/.github/workflows/recreate-lockfile.yml
index 3841bc3..eefa62c 100644
--- a/.github/workflows/recreate-lockfile.yml
+++ b/.github/workflows/recreate-lockfile.yml
@@ -26,7 +26,7 @@ jobs:
       pull-request-number: ${{ steps.cpr.outputs.pull-request-number }}
     steps:
       - name: Checkout Zenoh
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: eclipse-zenoh/zenoh
           ref: ${{ inputs.branch }}
@@ -79,7 +79,7 @@ jobs:
       - name: Create/Update a pull request if the lockfile changed
         id: cpr
         # NOTE: If there is a pending PR, this action will simply update it with a forced push.
-        uses: peter-evans/create-pull-request@v7
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
           title: "chore: recreate Cargo.lock"
           body: |

From 4f0ec5ba711bcc884bf8d2c5f539624351f909dd Mon Sep 17 00:00:00 2001
From: Diogo Mendes Matsubara <diogo.matsubara@zettascale.tech>
Date: Fri, 21 Aug 2026 17:55:05 +0200
Subject: [PATCH 3/4] chore: lower min-publish-age to 7 days

Not too conservative and not on the bleeding edge.
---
 .github/workflows/recreate-lockfile.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/recreate-lockfile.yml b/.github/workflows/recreate-lockfile.yml
index eefa62c..fc8da20 100644
--- a/.github/workflows/recreate-lockfile.yml
+++ b/.github/workflows/recreate-lockfile.yml
@@ -74,7 +74,7 @@ jobs:
       - name: Recreate Cargo.lock
         run: |
           rm -f Cargo.lock
-          cargo "+${RUST_TOOLCHAIN}" -Zmin-publish-age --config registry.global-min-publish-age='"14 days"' update --manifest-path Cargo.toml
+          cargo "+${RUST_TOOLCHAIN}" -Zmin-publish-age --config registry.global-min-publish-age='"7 days"' update --manifest-path Cargo.toml
 
       - name: Create/Update a pull request if the lockfile changed
         id: cpr

From d9c5f272ec80fb5954878a1538e5787cbfd97e71 Mon Sep 17 00:00:00 2001
From: Diogo Mendes Matsubara <diogo.matsubara@zettascale.tech>
Date: Mon, 24 Aug 2026 08:13:22 +0200
Subject: [PATCH 4/4] chore: predictable schedule

---
 .github/workflows/recreate-lockfile.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/recreate-lockfile.yml b/.github/workflows/recreate-lockfile.yml
index fc8da20..31ed6ff 100644
--- a/.github/workflows/recreate-lockfile.yml
+++ b/.github/workflows/recreate-lockfile.yml
@@ -2,7 +2,7 @@ name: Recreate Cargo lockfile
 
 on:
   schedule:
-    - cron: "0 0 */14 * *" # Run fortnightly at 00:00 UTC
+    - cron: "0 0 1,15 * *" # Run every 1st and 15th of the month at 00:00 UTC
   workflow_dispatch:
     inputs:
       branch: