[koehlma]

Update workflow actions to selected upstream commits and add version comments beside each full commit hash.

Rationale

Commit pins prevent upstream tags or branches from silently changing the action code executed by CI. Version comments keep the selected upstream references visible during review.

Action Updates

Action	Previous Reference	Pinned Version
PyO3/maturin-action	v1.51.0	v1.51.0
pypa/gh-action-pypi-publish	v1.14.2	v1.14.3
dtolnay/rust-toolchain	686976e191b8	v1
silitics/actions/deploy-site	3a1ebbdf07ce	main (2026-10-11)

Pin Selection

Rust toolchain references use the current v1 or channel-specific commit. Channel snapshots preserve the stable/nightly defaults; existing explicit compiler versions are unchanged. Dates in version comments identify action commits, not compiler releases.

Silitics actions have no published releases, so their pins identify the main-branch commit dated 2026-10-11.

Replace the annotated v1.51.0 tag object hash with its underlying release commit.

Validation

• Parsed workflow YAML and verified that only action references and comments changed.
• Checked existing action inputs against upstream metadata at the selected commits.
• Ran actionlint with no new findings and git diff --check.
• Existing pull request or branch-push workflows provide runtime validation. Manual and release-only workflows retain their triggers.

Risk Assessment

Blast Radius: Minor

Action upgrades could temporarily break repository workflows.

Reversibility: Easy

Revert the workflow references to restore the previous action implementations.

^{Created on behalf of @koehlma by Codex / GPT-6.1-sol (high) · Task}