Problem

There are example workflows provided in several places in The Cargo Book, such as:

• https://doc.rust-lang.org/cargo/guide/continuous-integration.html#github-actions
• https://doc.rust-lang.org/cargo/guide/continuous-integration.html#verifying-latest-dependencies
• https://doc.rust-lang.org/cargo/guide/continuous-integration.html#verifying-rust-version

These all use actions/checkout@v4. I'd suggest increasing this to at least actions/checkout@v6, as the checkout action was made more misuse-resistant (specifically with regards to ARTIPACKED) as of v6.

I think this change is worth making because defaults are important, and many people will just copy the workflows as-is and think nothing more of it.

Proposed Solution

I'd suggest increasing this to at least actions/checkout@v6, as the checkout action was made more misuse-resistant (specifically with regards to ARTIPACKED) as of v6.

In general, I'd advocate for using zizmor when possible to make proposed workflows more secure whenever possible.

Notes

I am not affiliated with zizmor, I just think it is a good tool.