ci: pin every action to one SHA, drop stale audit suppressions

[ArthurZucker]

Independent of the node dependency stack (#2286→#2290) — this one targets main directly.

A broken pin

PyO3/maturin-action@3e2bdf6ba645... is used twice in python-release.yml, commented # v1.51.0. That commit does not exist:

$ gh api repos/PyO3/maturin-action/commits/3e2bdf6ba6453a61e649744019b8a2d906c7eb38
No commit found for SHA (HTTP 422)

The real v1.51.0 is e83996d1. All maturin-action uses now point there.

Pin consolidation

Nine actions carried more than one pin — checkout ×3, upload-artifact ×3, cache ×3, plus setup-python, setup-node, download-artifact, maturin-action. Every distinct pin is a separate update to review, for no benefit.

Each is now a single SHA, chosen as the newest of the SHAs already in use in this repo (verified via commit dates through the API, so nothing untrusted is introduced):

action	SHA	tag
actions/checkout	de0fac2e	v6.0.2
actions/cache	27d5ce7f	v5.0.5
actions/download-artifact	3e5f45b2	v8.0.1
actions/setup-node	53b83947	v6.3.0
actions/setup-python	a309ff8b	v6.2.0
actions/upload-artifact	043fb46d	v7.0.1
PyO3/maturin-action	e83996d1	v1.51.0

Moving refs now pinned

Six uses tracked mutable refs. Most notable: huggingface/doc-builder/.github/workflows/build_main_documentation.yml@main — a third-party reusable workflow following a branch, in a repo that otherwise SHA-pins carefully.

Also dtolnay/rust-toolchain@stable, actions/stale@v9, astral-sh/setup-uv@v6, mozilla-actions/sccache-action@v0.0.9.

rust-toolchain follows the convention already proven in node.yml, docs-check.yml and rust-release.yml: SHA plus a # stable comment, no toolchain: input needed.

Stale audit suppressions

cargo audit suppressed five advisories. Auditing main's actual resolved graph, only two still fire — RUSTSEC-2024-0436 (paste) and RUSTSEC-2025-0119 (number_prefix), both unmaintained-crate warnings with no fix available. Those stay.

The three removed:

• RUSTSEC-2025-0014 — clearest case: that humantime advisory was withdrawn upstream on 2025-03-12. It cannot fire at all.
• RUSTSEC-2025-0057 (fxhash) and RUSTSEC-2026-0204 (crossbeam-epoch) — neither fires on main, which resolves crossbeam-epoch to the patched 0.9.20.

A suppression matching nothing isn't harmless: it silently hides a future recurrence of that same advisory.

⚠️ Heads-up for branches carrying committed lockfiles. main commits no Cargo.lock, so CI resolves fresh each run. Long-running branches that do commit locks (e.g. bitsplit) pin crossbeam-epoch 0.9.18, which is exactly RUSTSEC-2026-0204. With that ignore gone, audit will correctly flag it on merge — the fix is a cargo update -p crossbeam-epoch, not restoring the suppression.

Verification

• all 24 actions single-SHA pinned across 102 uses, zero moving refs remaining
• every workflow still parses as valid YAML
• both surviving cargo audit invocations verified against a real audit run

Not included

I had also flagged pytest-asyncio as an unused test extra. That was wrong — it's used via @pytest.mark.asyncio on the async tests in tests/bindings/test_tokenizer.py, which my import-only grep missed. It stays.

[HuggingFaceDocBuilderDev]

The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update.