ci: adopt hardened workflows from main

Author: nullPointerEnjoyer

.github/workflows/ci.yml

@@ -3,8 +3,14 @@ name: CI
 on:
   push:
     branches: [main]
+    paths-ignore: [".github/**"]
   pull_request:
     branches: [main]
+    paths-ignore: [".github/**"]
+
+# The crate jobs never need more than read access.
+permissions:
+  contents: read
 
 env:
   CARGO_TERM_COLOR: always
@@ -13,37 +19,47 @@ jobs:
   fmt:
     name: Format
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
+      # Pinned to the MSRV so rustfmt matches the version clippy/test use.
+      - uses: dtolnay/rust-toolchain@ffaa7fb73f2b6e3c49bc425913220fa3d71c3ee5 # 1.92.0
         with:
           components: rustfmt
       - run: cargo fmt --all --check
 
   clippy:
     name: Clippy (${{ matrix.features }})
     runs-on: ubuntu-latest
+    timeout-minutes: 45
     strategy:
       fail-fast: false
       matrix:
         features: ["--no-default-features", "--no-default-features --features node", "--no-default-features --features indexer", "--no-default-features --features wallet", "--no-default-features --features crypto", "--all-features"]
     steps:
       - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@1.92.0
+      - uses: dtolnay/rust-toolchain@ffaa7fb73f2b6e3c49bc425913220fa3d71c3ee5 # 1.92.0
         with:
           components: clippy
-      - run: cargo clippy ${{ matrix.features }} --all-targets -- -D warnings
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
+        with:
+          key: ${{ matrix.features }}
+      - run: cargo clippy ${{ matrix.features }} --all-targets --locked -- -D warnings
 
   test:
     name: Test (${{ matrix.features }})
     runs-on: ubuntu-latest
+    timeout-minutes: 45
     strategy:
       fail-fast: false
       matrix:
         features: ["--no-default-features", "--no-default-features --features node", "--no-default-features --features indexer", "--no-default-features --features wallet", "--no-default-features --features crypto", "--all-features"]
     steps:
       - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@1.92.0
+      - uses: dtolnay/rust-toolchain@ffaa7fb73f2b6e3c49bc425913220fa3d71c3ee5 # 1.92.0
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
+        with:
+          key: ${{ matrix.features }}
       - run: cargo test ${{ matrix.features }} --locked
 
   # Cross-platform test gate, mirroring mintlayer-core's build.yml: the full
@@ -55,6 +71,7 @@ jobs:
       matrix:
         os: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
+    timeout-minutes: 60
     steps:
       - name: Shorten CARGO_HOME on Windows
         if: runner.os == 'Windows'
@@ -64,23 +81,29 @@ jobs:
         # build.yml does this).
         run: echo "CARGO_HOME=C:\crg" >> "$GITHUB_ENV"
       - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@1.92.0
+      - uses: dtolnay/rust-toolchain@ffaa7fb73f2b6e3c49bc425913220fa3d71c3ee5 # 1.92.0
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
+        with:
+          key: ${{ matrix.os }}
       - run: cargo build --all-features --locked --examples
       - run: cargo test --all-features --locked
 
   doc:
     name: Documentation
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@1.92.0
-      - run: cargo doc --all-features --no-deps
+      - uses: dtolnay/rust-toolchain@ffaa7fb73f2b6e3c49bc425913220fa3d71c3ee5 # 1.92.0
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
+      - run: cargo doc --all-features --locked --no-deps
         env:
           RUSTDOCFLAGS: -D warnings
 
   license:
     name: License headers
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@v4
       - run: ./scripts/check-license.sh