From c3720c838aeb0eab2db01b5023b35941467a1bbc Mon Sep 17 00:00:00 2001
From: Vyncint Ng <115854244+vyncint@users.noreply.github.com>
Date: Mon, 5 Oct 2026 06:57:46 +0700
Subject: [PATCH] ci: repin dtolnay/rust-toolchain to where v1 points now

The action's `v1` tag is a moving tag. On 2026-10-01 at 22:51 UTC it moved
from 02cb101e to 7e38f4b4 when upstream merged one pull request, and
zizmor's online audits began failing on every use: the `# v1` comment no
longer named the pinned commit (ref-version-mismatch), and the commit no
longer pointed at any tag (stale-action-refs). The zizmor job, and with it
the required gate, fails on any run since.

The 1 pin(s) move to 7e38f4b43b4d. The SHA was read from the upstream tag,
which is a plain commit, and the upstream change between the two commits is
one file, action.yml, +16/-1: a retry loop around `rustup toolchain
install` for the release server's checksum error. termlens made the same
change as vyncint/termlens#554.

Signed-off-by: Vyncint Ng <115854244+vyncint@users.noreply.github.com>
---
 .github/workflows/install.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/install.yml b/.github/workflows/install.yml
index e128e0b..8d46cdf 100644
--- a/.github/workflows/install.yml
+++ b/.github/workflows/install.yml
@@ -103,7 +103,7 @@ jobs:
           echo "version=$version" >> "$GITHUB_OUTPUT"
           echo "msrv=$msrv" >> "$GITHUB_OUTPUT"
           echo "verifying launchbound-cli $version, which declares Rust $msrv"
-      - uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # v1
+      - uses: dtolnay/rust-toolchain@7e38f4b43b4db5c8dd498af069a4f6196df1d067 # v1
         with:
           toolchain: ${{ matrix.toolchain == 'msrv' && steps.crate.outputs.msrv || 'stable' }}
       - name: cargo install, from an empty directory