fix(ci): harden release workflows and repository checks

.github/workflows/ci.yml

@@ -103,7 +103,7 @@ jobs:
           setup_only: true
 
       - name: Install protoc-gen-buffa
-        run: cargo install protoc-gen-buffa@0.9.1 protoc-gen-buffa-packaging@0.9.1
+        run: cargo install --locked protoc-gen-buffa@0.9.1 protoc-gen-buffa-packaging@0.9.1
 
       - name: Verify proto bindings are up to date
         run: |

.github/workflows/release-please.yml

@@ -5,11 +5,14 @@ on:
     branches: [main]
 
 permissions:
-  contents: write
-  pull-requests: write
+  contents: read
 
 jobs:
   release-please:
+    environment: release
+    permissions:
+      contents: write
+      pull-requests: write
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:

.github/workflows/release.yml

@@ -72,6 +72,7 @@ jobs:
           DATABASE_URL: postgres://sqlc:sqlc@localhost:5432/sqlc_test
 
   publish-release:
+    environment: release
     needs: verify
     runs-on: ubuntu-latest
     timeout-minutes: 15

hk.pkl

@@ -183,8 +183,7 @@ local checks = new Mapping<String, Step> {
   // Rust.
   ["cargo-lockfile"] = new Step {
     glob = List("Cargo.toml", "Cargo.lock", "**/Cargo.toml")
-    check =
-      "worktree=$(mktemp -d) && trap 'rm -rf \"$worktree\"' EXIT && git ls-files -z | tar --null -T - -cf - | tar -xf - -C \"$worktree\" && cargo generate-lockfile --manifest-path \"$worktree/Cargo.toml\" && diff -u Cargo.lock \"$worktree/Cargo.lock\""
+    check = "cargo metadata --locked --format-version 1 --all-features > /dev/null"
     profiles = slow
   }
   ["cargo-fmt"] = (Builtins.cargo_fmt) {