ci: harden release action (#113)

.github/workflows/ci.yml

@@ -156,12 +156,19 @@ jobs:
     if: github.ref == 'refs/heads/release' || startsWith(github.ref, 'refs/tags/release')
     needs: [fmt, clippy, test]
     steps:
-      - uses: actions/checkout@v3
+      # Since this job has access to the `CRATES_TOKEN`, it's probably a good
+      # idea to be extra careful about what Actions are being called. The reason
+      # is that if an attacker gains access to other actions such as
+      # `Swatinem/rust-cache`, they could use that to steal the `CRATES_TOKEN`.
+      # This happened recently in the attack on `tj-actions/changed-files`, but
+      # has happened many times before as well.
 
-      - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
+      - uses: actions/checkout@v4
 
-      - uses: Swatinem/rust-cache@v2
+      - name: Update Rust
+        run: | 
+          rustup update stable
+          rustup default stable
 
       - name: Cargo login
         run: cargo login ${{ secrets.CRATES_TOKEN }}