chore(deps): harden dependency updates (#28)

.github/workflows/check.yml

@@ -17,4 +17,4 @@ jobs:
       - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@1.88.0
       - uses: Swatinem/rust-cache@v2.9.1
-      - run: cargo check
+      - run: cargo check --locked

.github/workflows/clippy.yml

@@ -19,4 +19,4 @@ jobs:
         with:
           components: clippy
       - uses: Swatinem/rust-cache@v2.9.1
-      - run: cargo clippy --all-targets -- -D warnings
+      - run: cargo clippy --locked --all-targets -- -D warnings

.github/workflows/coverage.yml

@@ -20,7 +20,7 @@ jobs:
           components: llvm-tools-preview
       - uses: Swatinem/rust-cache@v2.9.1
       - uses: taiki-e/install-action@cargo-llvm-cov
-      - run: cargo llvm-cov --workspace --all-targets --lcov --output-path lcov.info
+      - run: cargo llvm-cov --locked --workspace --all-targets --lcov --output-path lcov.info
       - name: Upload coverage reports to Codecov
         uses: codecov/codecov-action@v7
         if: github.event_name == 'push' && github.ref == 'refs/heads/main'

.github/workflows/cross-platform.yml

@@ -23,5 +23,5 @@ jobs:
       - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@1.88.0
       - uses: Swatinem/rust-cache@v2.9.1
-      - run: cargo check
-      - run: cargo test
+      - run: cargo check --locked
+      - run: cargo test --locked

.github/workflows/release.yml

@@ -63,8 +63,8 @@ jobs:
       - name: Verify package
         if: steps.tag.outputs.exists == 'false'
         run: |
-          cargo package
-          cargo test
+          cargo package --locked
+          cargo test --locked
 
       - name: Authenticate with crates.io
         if: steps.tag.outputs.exists == 'false'

.github/workflows/test.yml

@@ -17,4 +17,4 @@ jobs:
       - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@1.88.0
       - uses: Swatinem/rust-cache@v2.9.1
-      - run: cargo test
+      - run: cargo test --locked