lme-python 0.1.11__tar.gz → 0.2.2__tar.gz

lme_python-0.2.2/.github/dependabot.yml

@@ -0,0 +1,10 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      github-actions:
+        patterns:
+          - "*"

lme_python-0.2.2/.github/workflows/audit.yml

@@ -0,0 +1,62 @@
+name: Security audit
+
+# Release CI calls this workflow as a required publication gate.
+# A weekly schedule and workflow_dispatch provide continuous/on-demand audits.
+
+on:
+  workflow_call:
+  workflow_dispatch:
+  schedule:
+    - cron: "17 4 * * 1"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: audit-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  audit:
+    name: cargo audit
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
+        with:
+          toolchain: stable
+
+      - name: Install cargo-audit
+        uses: taiki-e/install-action@7f4eb899022d8fe70b20c4f3de697aa85c309026 # v2
+        with:
+          tool: cargo-audit@0.22.1
+
+      - name: Run cargo audit (root)
+        # paste is required by argmin 0.11; RUSTSEC-2024-0436 is informational
+        # and has no patched argmin release. Deny every other warning.
+        run: cargo audit --deny warnings --ignore RUSTSEC-2024-0436
+
+      - name: Run cargo audit (python/)
+        working-directory: python
+        run: cargo audit --deny warnings --ignore RUSTSEC-2024-0436
+
+  pip-audit:
+    name: pip-audit (uv.lock)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        with:
+          python-version: "3.11"
+          enable-cache: true
+          cache-dependency-glob: "python/uv.lock"
+
+      - name: pip-audit
+        working-directory: python
+        run: |
+          set -euo pipefail
+          uv sync --extra dev --no-install-project
+          uv run --no-sync pip-audit

{lme_python-0.1.11 → lme_python-0.2.2}/.github/workflows/benchmarks.yml

@@ -29,15 +29,17 @@ jobs:
     name: Criterion Benchmarks
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
+        with:
+          toolchain: stable
 
       - name: Install OpenBLAS
         run: sudo apt-get update && sudo apt-get install -y libopenblas-dev
 
       - name: Cache cargo registry and build outputs
-        uses: actions/cache@v5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             ~/.cargo/registry
@@ -55,7 +57,7 @@ jobs:
           tar -czf "benchmark-results/criterion-${{ github.sha }}.tar.gz" target/criterion
 
       - name: Upload Criterion artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: criterion-${{ github.sha }}
           path: benchmark-results/criterion-${{ github.sha }}.tar.gz
@@ -82,11 +84,13 @@ jobs:
       BENCH_REPEATS: ${{ github.event_name == 'workflow_dispatch' && inputs.repeats || '3' }}
       R_LIBS_USER: ${{ github.workspace }}/.r-lib
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
+        with:
+          toolchain: stable
 
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.11"
 
@@ -101,7 +105,7 @@ jobs:
           julia --version
 
       - name: Cache cargo registry and build outputs
-        uses: actions/cache@v5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             ~/.cargo/registry
@@ -157,9 +161,10 @@ jobs:
 
       - name: Upload cross-language artifact
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: cross-language-${{ github.sha }}
+          if-no-files-found: ignore
           path: |
             benchmark-results/cross-language-${{ github.sha }}.json
             benchmark-results/fair-rust-julia-${{ github.sha }}.json
@@ -176,9 +181,13 @@ jobs:
               gh release create "${GITHUB_REF_NAME}" --title "${GITHUB_REF_NAME}"
             fi
           }
-          gh release upload "${GITHUB_REF_NAME}" "benchmark-results/cross-language-${{ github.sha }}.json" --clobber
-          if [ -f "benchmark-results/fair-rust-julia-${{ github.sha }}.json" ]; then
-            gh release upload "${GITHUB_REF_NAME}" "benchmark-results/fair-rust-julia-${{ github.sha }}.json" --clobber
+          cross_json="benchmark-results/cross-language-${{ github.sha }}.json"
+          fair_json="benchmark-results/fair-rust-julia-${{ github.sha }}.json"
+          if [ -f "$cross_json" ]; then
+            gh release upload "${GITHUB_REF_NAME}" "$cross_json" --clobber
+          fi
+          if [ -f "$fair_json" ]; then
+            gh release upload "${GITHUB_REF_NAME}" "$fair_json" --clobber
           fi
 
       - name: Fail if cross-language benchmarks failed

lme_python-0.2.2/.github/workflows/cache-prime.yml

@@ -0,0 +1,121 @@
+name: Prime Rust caches
+
+# PR caches are scoped to a single pull request. Keep trusted default-branch
+# dependency caches warm so new PRs do not start by rebuilding Polars and BLAS.
+
+on:
+  push:
+    branches:
+      - master
+    paths:
+      - "Cargo.toml"
+      - "Cargo.lock"
+      - "python/Cargo.toml"
+      - "python/Cargo.lock"
+      - "rust-toolchain"
+      - "rust-toolchain.toml"
+      - ".cargo/**"
+      - ".github/workflows/ci.yml"
+      - ".github/workflows/cache-prime.yml"
+  schedule:
+    - cron: "17 3 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: cache-prime-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  CARGO_TERM_COLOR: always
+  CARGO_INCREMENTAL: "0"
+  CARGO_PROFILE_DEV_DEBUG: "0"
+  CARGO_PROFILE_TEST_DEBUG: "0"
+
+jobs:
+  rust-dependencies:
+    name: Rust dependencies (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
+        with:
+          toolchain: stable
+      - name: Install OpenBLAS (Ubuntu)
+        if: matrix.os == 'ubuntu-latest'
+        run: sudo apt-get update && sudo apt-get install -y libopenblas-dev
+      - name: Set OpenBLAS target (macOS)
+        if: matrix.os == 'macos-latest'
+        run: echo "OPENBLAS_TARGET=ARMV8" >> "$GITHUB_ENV"
+      - name: Cache Rust dependencies
+        uses: Swatinem/rust-cache@a45951ff880207c249adf57334cf2e9bd81d6e1e # v2
+        with:
+          shared-key: ci-v2-${{ runner.os }}-rust-test
+          cache-workspace-crates: ${{ runner.os != 'Linux' }}
+      - name: Compile canonical test dependencies
+        if: matrix.os == 'ubuntu-latest'
+        run: cargo test --locked --no-run
+      - name: Compile consolidated test dependencies
+        if: matrix.os != 'ubuntu-latest'
+        run: python scripts/ci/lme_ci.py consolidated-test --no-run
+
+  production-dependencies:
+    name: Production-load dependencies (ubuntu)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
+        with:
+          toolchain: stable
+      - name: Install OpenBLAS
+        run: sudo apt-get update && sudo apt-get install -y libopenblas-dev
+      - name: Cache production-load Rust dependencies
+        uses: Swatinem/rust-cache@a45951ff880207c249adf57334cf2e9bd81d6e1e # v2
+        with:
+          shared-key: ci-v2-${{ runner.os }}-rust-release
+          cache-workspace-crates: true
+      - name: Compile production-load dependencies
+        run: cargo test --release --locked --test test_production_load --no-run
+
+  python-dependencies:
+    name: Python dependencies (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
+        with:
+          toolchain: stable
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.11"
+      - name: Install OpenBLAS (Ubuntu)
+        if: matrix.os == 'ubuntu-latest'
+        run: sudo apt-get update && sudo apt-get install -y libopenblas-dev
+      - name: Set OpenBLAS target (macOS)
+        if: matrix.os == 'macos-latest'
+        run: echo "OPENBLAS_TARGET=ARMV8" >> "$GITHUB_ENV"
+      - name: Cache Python Rust dependencies
+        uses: Swatinem/rust-cache@a45951ff880207c249adf57334cf2e9bd81d6e1e # v2
+        with:
+          shared-key: ci-${{ runner.os }}-python
+          workspaces: python -> target
+      - name: Compile Python binding dependencies
+        if: matrix.os != 'macos-latest'
+        env:
+          PYO3_PYTHON: python
+        run: cargo build --release --manifest-path python/Cargo.toml
+      - name: Compile Python binding dependencies (macOS)
+        if: matrix.os == 'macos-latest'
+        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1
+        with:
+          args: --release --out python/dist --manifest-path python/Cargo.toml

lme_python-0.2.2/.github/workflows/ci.yml

@@ -0,0 +1,267 @@
+name: CI
+
+# Automatic runs: pull requests and v* release tags. Use workflow_dispatch for
+# an intentional full check on any branch (Actions → CI → Run workflow).
+
+on:
+  pull_request:
+  push:
+    tags:
+      - "v*"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  CARGO_TERM_COLOR: always
+  CARGO_INCREMENTAL: "0"
+  CARGO_PROFILE_DEV_DEBUG: "0"
+  CARGO_PROFILE_TEST_DEBUG: "0"
+
+jobs:
+  release-policy:
+    name: Release policy checks
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.11"
+      - name: Validate legal notices and provenance
+        run: python3 scripts/ci/lme_ci.py legal
+      - name: Validate Markdown links
+        run: python3 scripts/ci/lme_ci.py docs-links
+      - name: Validate completion score claims
+        run: python3 scripts/ci/lme_ci.py completion-check
+
+  security-audit:
+    name: Dependency security audit
+    permissions:
+      contents: read
+    uses: ./.github/workflows/audit.yml
+
+  rust-ubuntu:
+    name: Rust validation (ubuntu)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
+        with:
+          toolchain: stable
+      - name: Install OpenBLAS
+        run: sudo apt-get update && sudo apt-get install -y libopenblas-dev
+      - name: Cache Rust dependencies
+        uses: Swatinem/rust-cache@a45951ff880207c249adf57334cf2e9bd81d6e1e # v2
+        with:
+          shared-key: ci-v2-${{ runner.os }}-rust-test
+          save-if: ${{ github.event_name == 'pull_request' || github.ref == 'refs/heads/master' }}
+      - name: rustfmt --check
+        id: rustfmt
+        continue-on-error: true
+        run: python3 scripts/ci/lme_ci.py fmt-check
+      - name: clippy
+        id: clippy
+        continue-on-error: true
+        run: python3 scripts/ci/lme_ci.py clippy
+      - name: cargo check --workspace --all-targets
+        id: check
+        continue-on-error: true
+        run: python3 scripts/ci/lme_ci.py check
+      - name: Run tests
+        id: tests
+        continue-on-error: true
+        run: python3 scripts/ci/lme_ci.py build-test
+      - name: Run doctests
+        id: doctests
+        continue-on-error: true
+        run: python3 scripts/ci/lme_ci.py doctest
+      - name: Build documentation
+        id: docs
+        continue-on-error: true
+        run: python3 scripts/ci/lme_ci.py doc
+      - name: Report Rust validation failures
+        if: >-
+          ${{ !cancelled() && (
+            steps.rustfmt.outcome == 'failure' ||
+            steps.clippy.outcome == 'failure' ||
+            steps.check.outcome == 'failure' ||
+            steps.tests.outcome == 'failure' ||
+            steps.doctests.outcome == 'failure' ||
+            steps.docs.outcome == 'failure'
+          ) }}
+        run: exit 1
+
+  test:
+    name: Test (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [windows-latest, macos-latest]
+
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
+        with:
+          toolchain: stable
+
+      - name: Cache Rust dependencies
+        uses: Swatinem/rust-cache@a45951ff880207c249adf57334cf2e9bd81d6e1e # v2
+        with:
+          shared-key: ci-v2-${{ runner.os }}-rust-test
+          cache-workspace-crates: true
+          save-if: ${{ github.event_name == 'pull_request' || github.ref == 'refs/heads/master' }}
+
+      - name: Set OpenBLAS target (macOS)
+        if: matrix.os == 'macos-latest'
+        run: echo "OPENBLAS_TARGET=ARMV8" >> "$GITHUB_ENV"
+
+      - name: Run tests
+        run: python scripts/ci/lme_ci.py consolidated-test
+
+  production-load:
+    name: Production load & perf gates (ubuntu, release)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
+        with:
+          toolchain: stable
+
+      - name: Install OpenBLAS (Ubuntu)
+        run: sudo apt-get update && sudo apt-get install -y libopenblas-dev
+
+      - name: Restore Rust dependencies
+        uses: Swatinem/rust-cache@a45951ff880207c249adf57334cf2e9bd81d6e1e # v2
+        with:
+          shared-key: ci-v2-${{ runner.os }}-rust-release
+          cache-workspace-crates: true
+          save-if: ${{ github.event_name == 'pull_request' || github.ref == 'refs/heads/master' }}
+
+      - name: Production load tests (smoke + release wall-clock gates)
+        run: cargo test --release --locked --verbose --test test_production_load
+
+      - name: Heavy production load tests (ignored)
+        if: github.event_name != 'pull_request'
+        run: cargo test --release --locked --verbose --test test_production_load -- --ignored --test-threads=1
+
+  python-bindings-versions:
+    name: Python ${{ matrix.python-version }} (ubuntu)
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.10", "3.11", "3.12", "3.13"]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
+        with:
+          toolchain: stable
+      - name: Install OpenBLAS
+        run: sudo apt-get update && sudo apt-get install -y libopenblas-dev
+      - name: Cache Python Rust dependencies
+        uses: Swatinem/rust-cache@a45951ff880207c249adf57334cf2e9bd81d6e1e # v2
+        with:
+          shared-key: ci-${{ runner.os }}-python
+          workspaces: python -> target
+          save-if: ${{ matrix.python-version == '3.11' && (github.event_name == 'pull_request' || github.ref == 'refs/heads/master') }}
+      - name: Set up uv
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        with:
+          python-version: ${{ matrix.python-version }}
+          enable-cache: true
+          cache-dependency-glob: "python/uv.lock"
+
+      - name: Python bindings (canonical editable identity + isolated wheel)
+        if: matrix.python-version == '3.11'
+        run: python scripts/ci/lme_ci.py python --python-version ${{ matrix.python-version }} --examples
+
+      - name: Python bindings (isolated wheel compatibility)
+        if: matrix.python-version != '3.11'
+        run: python scripts/ci/lme_ci.py python --python-version ${{ matrix.python-version }} --wheel-only
+
+  python-bindings-os:
+    name: Python 3.11 (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [windows-latest, macos-latest]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
+        with:
+          toolchain: stable
+      - name: Set OpenBLAS target (macOS)
+        if: matrix.os == 'macos-latest'
+        run: echo "OPENBLAS_TARGET=ARMV8" >> "$GITHUB_ENV"
+      - name: Cache Python Rust dependencies
+        uses: Swatinem/rust-cache@a45951ff880207c249adf57334cf2e9bd81d6e1e # v2
+        with:
+          shared-key: ci-${{ runner.os }}-python
+          workspaces: python -> target
+          save-if: ${{ github.event_name == 'pull_request' || github.ref == 'refs/heads/master' }}
+      - name: Set up uv
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        with:
+          python-version: "3.11"
+          enable-cache: true
+          cache-dependency-glob: "python/uv.lock"
+      - name: Python bindings (isolated wheel OS compatibility)
+        run: python scripts/ci/lme_ci.py python --python-version 3.11 --wheel-only --examples
+
+  publish-crate:
+    name: Publish Rust crate after CI
+    if: startsWith(github.ref, 'refs/tags/v')
+    needs:
+      - release-policy
+      - security-audit
+      - rust-ubuntu
+      - test
+      - production-load
+      - python-bindings-versions
+      - python-bindings-os
+    permissions:
+      contents: read
+    uses: ./.github/workflows/crate-publish-dry-run.yml
+    with:
+      publish: true
+    secrets: inherit
+
+  publish-python:
+    name: Dispatch Python release after CI
+    if: startsWith(github.ref, 'refs/tags/v')
+    needs:
+      - release-policy
+      - security-audit
+      - rust-ubuntu
+      - test
+      - production-load
+      - python-bindings-versions
+      - python-bindings-os
+    permissions:
+      actions: write
+      contents: read
+    runs-on: ubuntu-latest
+    steps:
+      - name: Dispatch verified Python release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_SHA: ${{ github.sha }}
+          RELEASE_TAG: ${{ github.ref_name }}
+        run: |
+          gh workflow run python-release.yml \
+            --repo "${GITHUB_REPOSITORY}" \
+            --ref master \
+            -f release_tag="${RELEASE_TAG}" \
+            -f release_sha="${RELEASE_SHA}" \
+            -f publish=true

{lme_python-0.1.11 → lme_python-0.2.2}/.github/workflows/crate-publish-dry-run.yml

@@ -1,12 +1,16 @@
 name: Publish Rust crate
 
-# Publishes to crates.io only on v* tag pushes. Manual dispatch validates with
-# cargo publish --dry-run (no registry token required).
+# CI calls this workflow after every release-tag validation job succeeds.
+# Manual dispatch validates with cargo publish --dry-run and never publishes.
 
 on:
-  push:
-    tags:
-      - "v*"
+  workflow_call:
+    inputs:
+      publish:
+        description: Publish the validated release tag to crates.io
+        required: false
+        type: boolean
+        default: false
   workflow_dispatch:
 
 permissions:
@@ -21,16 +25,17 @@ jobs:
     name: cargo publish
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
+        with:
+          toolchain: stable
 
       - name: Validate crate package (dry run)
-        if: github.event_name == 'workflow_dispatch'
         run: cargo publish --dry-run --locked
 
       - name: Publish root crate
-        if: startsWith(github.ref, 'refs/tags/')
+        if: inputs.publish && startsWith(github.ref, 'refs/tags/v')
         env:
           CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
         run: |

{lme_python-0.1.11 → lme_python-0.2.2}/.github/workflows/fuzz-smoke.yml

@@ -1,8 +1,17 @@
-# Manual libFuzzer smoke (long compile + short run). Trigger from the Actions tab.
-name: Fuzz (manual)
+# Weekly and manually dispatched libFuzzer smoke.
+name: Fuzz smoke
 
 on:
   workflow_dispatch:
+  schedule:
+    - cron: "43 3 * * 0"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: fuzz-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 
 jobs:
   libfuzzer-smoke:
@@ -13,14 +22,16 @@ jobs:
         working-directory: fuzz
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: dtolnay/rust-toolchain@nightly
+      - uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # nightly
+        with:
+          toolchain: nightly
 
       - name: Install cargo-fuzz
-        run: cargo install cargo-fuzz --locked
+        run: cargo install cargo-fuzz@0.13.2 --locked
 
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@a45951ff880207c249adf57334cf2e9bd81d6e1e # v2
         with:
           workspaces: fuzz