From e0196b1aaabf4b570c0c2d6762a4c8fe26b85865 Mon Sep 17 00:00:00 2001
From: Jed Salazar <jed@edera.dev>
Date: Thu, 20 Aug 2026 11:46:02 -0600
Subject: [PATCH 1/2] ci: ban arrayref 0.3.10 and proc-macro1

---
 .github/workflows/ci.yml | 13 ++++++++++++-
 deny.toml                | 11 +++++++++++
 2 files changed, 23 insertions(+), 1 deletion(-)
 create mode 100644 deny.toml

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index eacb31dc6e..4149861815 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -46,7 +46,18 @@ jobs:
         uses: actions/checkout@v5
 
       - name: Check feature ${{ matrix.feature }}
-        run: cargo check --no-default-features --features ${{ matrix.feature }}
+        run: cargo check --locked --no-default-features --features ${{ matrix.feature }}
+
+  cargo_deny:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Clone repository
+        uses: actions/checkout@v5
+
+      - name: Check bans
+        uses: EmbarkStudios/cargo-deny-action@v2
+        with:
+          command: check bans
 
   toml_format:
     runs-on: ubuntu-latest
diff --git a/deny.toml b/deny.toml
new file mode 100644
index 0000000000..a32914b808
--- /dev/null
+++ b/deny.toml
@@ -0,0 +1,11 @@
+# arrayref 0.3.10 was published from a compromised owner account and pulls in
+# proc-macro1, a typosquat of proc-macro2 whose build script downloads and
+# executes a remote binary. All earlier arrayref releases were yanked to
+# pressure consumers into updating to the malicious version. arrayref reaches
+# this tree via blake3; keep it pinned at the version in Cargo.lock and do not
+# update past these bans until crates.io removes the malicious release.
+[bans]
+deny = [
+  { crate = "arrayref@0.3.10", reason = "malicious release from compromised owner account" },
+  { crate = "proc-macro1", reason = "typosquat of proc-macro2; build script executes a remote binary" },
+]

From 2f172e5bf9fd94838aa2e99952e427f44abd4476 Mon Sep 17 00:00:00 2001
From: Jed Salazar <jed@edera.dev>
Date: Thu, 20 Aug 2026 11:52:46 -0600
Subject: [PATCH 2/2] ci: pin actions by sha, add harden-runner

---
 .github/workflows/ci.yml | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4149861815..bec912274c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -51,11 +51,16 @@ jobs:
   cargo_deny:
     runs-on: ubuntu-latest
     steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        with:
+          egress-policy: audit
+
       - name: Clone repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
 
       - name: Check bans
-        uses: EmbarkStudios/cargo-deny-action@v2
+        uses: EmbarkStudios/cargo-deny-action@3c6349835b2b7b196a839186cb8b78e02f7b5f25 # v2.1.1
         with:
           command: check bans