From e7d2340a64ae0e7dd164dbd178659c98b42ae365 Mon Sep 17 00:00:00 2001
From: Vyncint Ng <115854244+vyncint@users.noreply.github.com>
Date: Tue, 27 Oct 2026 19:06:49 +0700
Subject: [PATCH] ci: repin dtolnay/rust-toolchain to where v1 points now

The action's `v1` tag moved twice after the last repin. On 2026-10-09
it moved from 7e38f4b4 to e2a55d2f (upstream #187, "Safely handle action
inputs": action.yml +29/-20). On 2026-10-16 it moved to 683b588c, which
adds the 1.99.1 patch release to scripts/update-revs.sh. zizmor's online
audits fail on the stale pin (ref-version-mismatch and stale-action-refs),
so the zizmor job fails on every run, and the required gate with it.

The 1 pin(s) move to 683b588c487a. The SHA was read from the upstream tag,
a plain commit, with `gh api`.

Signed-off-by: Vyncint Ng <115854244+vyncint@users.noreply.github.com>
---
 .github/workflows/install.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/install.yml b/.github/workflows/install.yml
index 5c44a83..aafad7f 100644
--- a/.github/workflows/install.yml
+++ b/.github/workflows/install.yml
@@ -95,7 +95,7 @@ jobs:
 
           echo "version=$version" >> "$GITHUB_OUTPUT"
           echo "verifying cargo-reconverge $version"
-      - uses: dtolnay/rust-toolchain@7e38f4b43b4db5c8dd498af069a4f6196df1d067 # v1
+      - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # v1
         with:
           toolchain: stable
       - name: cargo install, from an empty directory