CI: lock dependencies and harden cache key

Author: Codex

.github/workflows/ci.yml

@@ -8,6 +8,7 @@ on:
 
 env:
   CARGO_TERM_COLOR: always
+  CARGO_NET_GIT_FETCH_WITH_CLI: "true"
 
 jobs:
   build:
@@ -34,21 +35,21 @@ jobs:
             ~/.cargo/registry/cache/
             ~/.cargo/git/db/
             target/
-          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
+          key: ${{ runner.os }}-cargo-${{ hashFiles('rust-toolchain*', '**/Cargo.lock') }}
           restore-keys: |
             ${{ runner.os }}-cargo-
 
       - name: Cargo fmt
         run: cargo fmt -- --check
 
       - name: Cargo clippy
-        run: cargo clippy -- -D warnings
+        run: cargo clippy --locked -- -D warnings
 
       - name: Cargo test
-        run: cargo test
+        run: cargo test --locked
 
       - name: Cargo build (release)
-        run: cargo build --release
+        run: cargo build --release --locked
 
       - name: Upload artifact
         uses: actions/upload-artifact@v4