chore: Pin actions-rust-lang/setup-rust-toolchain to SHA digest

[erezrokah]

Pin actions-rust-lang/setup-rust-toolchain from mutable tag @v1 to immutable SHA @150fca883cd4034361b621bd4e6a9d34e5143606 in .github/actions/setup-rust/action.yml, preventing supply chain attacks via tag hijacking. This was missed by #92016 which pinned 19 other actions.

Recommendations

These items require manual follow-up and are NOT included as code changes in this PR.

• [MEDIUM] wasm-pack curl|sh — .github/workflows/build_and_deploy.yml:385 uses curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh. Consider replacing with a pinned install method when one becomes available.
• [MEDIUM] npm install without lockfile — .github/workflows/pull_request_stats.yml:122 runs npm install in .github/actions/next-stats-action/ which has no package-lock.json. Consider committing a lockfile and switching to npm ci.

[nextjs-bot]

Allow CI Workflow Run

• approve CI run for commit: 67ab73f

Note: this should only be enabled once the PR is ready to go and can only be enabled by a maintainer

[Copilot]

Pull request overview

Pins the external GitHub Action used by the repo’s internal composite “Rust Setup” action to an immutable commit SHA to reduce supply-chain risk from mutable tags.

Changes:

• Update actions-rust-lang/setup-rust-toolchain usage from @v1 to a specific commit SHA (with a # v1 reference comment).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[bgw]

Doing this in #93609
I'm also pinning all of the actions/* ones because I want to enable a blanket enforcement rule on the repository so that we don't risk regressing on this.

Thank you for pointing this out!

[erezrokah]

Thanks for the review @bgw, I highly recommend setting up renovate to manage the sha pinning and provide visibility into updates (hard to understand changes between versions when using sha pinning).
Renovate has a best practices config (which does more things), but the minimal change would be to use the pin GitHub Actions digest helper.

Finally, if you don't want to install an additional GitHub App into the Vercel org, you can self host (e.g. via the GitHub Action https://github.com/renovatebot/github-action).

P.S. I don't work for renovate or anything like that, just it has been super helpful for us to tighten our supply chain attack surface