From c61f5243f8ed34cd4bee8f1982a9d02d840f630a Mon Sep 17 00:00:00 2001
From: Randolf Jung <randolf@mathematic.io>
Date: Sat, 5 Sep 2026 02:32:38 -0700
Subject: [PATCH 1/2] fix(ci): harden release workflows and repository checks

---
 .github/workflows/release-please.yml | 7 +++++--
 .github/workflows/release.yml        | 1 +
 hk.pkl                               | 3 +--
 3 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index f81968c..d5a32e5 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -5,11 +5,14 @@ on:
     branches: [main]
 
 permissions:
-  contents: write
-  pull-requests: write
+  contents: read
 
 jobs:
   release-please:
+    environment: release
+    permissions:
+      contents: write
+      pull-requests: write
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 771f126..81cf04a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -72,6 +72,7 @@ jobs:
           DATABASE_URL: postgres://sqlc:sqlc@localhost:5432/sqlc_test
 
   publish-release:
+    environment: release
     needs: verify
     runs-on: ubuntu-latest
     timeout-minutes: 15
diff --git a/hk.pkl b/hk.pkl
index 9d1d95a..751ee77 100644
--- a/hk.pkl
+++ b/hk.pkl
@@ -183,8 +183,7 @@ local checks = new Mapping<String, Step> {
   // Rust.
   ["cargo-lockfile"] = new Step {
     glob = List("Cargo.toml", "Cargo.lock", "**/Cargo.toml")
-    check =
-      "worktree=$(mktemp -d) && trap 'rm -rf \"$worktree\"' EXIT && git ls-files -z | tar --null -T - -cf - | tar -xf - -C \"$worktree\" && cargo generate-lockfile --manifest-path \"$worktree/Cargo.toml\" && diff -u Cargo.lock \"$worktree/Cargo.lock\""
+    check = "cargo metadata --locked --format-version 1 --all-features > /dev/null"
     profiles = slow
   }
   ["cargo-fmt"] = (Builtins.cargo_fmt) {

From 745b3577fb9c353248d82943104c37628ed75b30 Mon Sep 17 00:00:00 2001
From: Randolf Jung <randolf@mathematic.io>
Date: Sat, 5 Sep 2026 02:43:43 -0700
Subject: [PATCH 2/2] fix(ci): lock protobuf generator dependencies

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a36fbcb..235616c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -103,7 +103,7 @@ jobs:
           setup_only: true
 
       - name: Install protoc-gen-buffa
-        run: cargo install protoc-gen-buffa@0.9.1 protoc-gen-buffa-packaging@0.9.1
+        run: cargo install --locked protoc-gen-buffa@0.9.1 protoc-gen-buffa-packaging@0.9.1
 
       - name: Verify proto bindings are up to date
         run: |