[0xNeshi]

No description provided.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[Copilot]

🟢 Approval recommended

The review reports no active issues with the workflow hardening and publishing authentication changes.

No open issues 🎉

What changed in this PR

This PR hardens GitHub Actions workflows for the Rust crate, updates crates.io publishing authentication, and adds compatibility and security checks.

Changes:

• Disable persisted checkout credentials and explicitly limit benchmark workflow permissions.
• Publish on release publication using short-lived crates.io tokens obtained through OpenID Connect.
• Add semver and zizmor checks, while removing runner auditing from two existing check jobs.

File	Description
.github/​workflows/​test.yml	Disable persisted checkout credentials in tests.
.github/​workflows/​publish.yml	Switch to release-triggered publishing with short-lived authentication.
.github/​workflows/​pr_benchmarks.yml	Set read-only permissions and disable persisted checkout credentials.
.github/​workflows/​check.yml	Add semver and security checks, harden checkouts, and adjust runner auditing.
.github/​workflows/​base_benchmarks.yml	Set read-only permissions and disable persisted checkout credentials.

_{Review effort: Balanced}