ci: audit and harden GitHub Actions workflows

- Bump all actions to latest versions (checkout@v6, upload-artifact@v7,
  download-artifact@v8, labeler@v6, gh-release@v3, gpg-import@v7)
- Replace fragile curl|bash tool install with taiki-e/install-action@v2
- Fix Swatinem/rust-cache ordering: must run AFTER toolchain install
  for correct cache key derivation
- Add --all-targets to clippy (CI now matches local testing)
- Add RUSTDOCFLAGS=-D warnings to doc step (fail on broken links)
- Fix ARM64 build order: install Rust toolchain before adding target
  and configuring linker
- Add rust-toolchain.toml pinning Rust 1.94.0 for deterministic builds
- Update Cargo.lock: rustls-webpki v0.103.11->v0.103.13 (fixes 3 CVEs)
- Fix softprops/action-gh-release@v3: include checksums in files list
  (v3 removed the checksum input parameter)
- Fix clippy manual_checked_ops lint in screenshot.rs
- Clean up trailing whitespace and missing newlines in YAML files

.github/workflows/release.yml

@@ -9,7 +9,7 @@ env:
   CARGO_TERM_COLOR: always
 
 jobs:
-  release-build:
+  release-build-x86:
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
@@ -33,7 +33,7 @@ jobs:
     container: ${{ matrix.distro == 'ubuntu' && 'ubuntu:latest' || matrix.distro == 'debian' && 'debian:stable-slim' || matrix.distro == 'fedora' && 'fedora:latest' || 'archlinux:latest' }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Install system dependencies (Ubuntu/Debian)
         if: matrix.distro == 'ubuntu' || matrix.distro == 'debian'
@@ -75,31 +75,118 @@ jobs:
         run: cargo build --release ${{ matrix.args }}
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: rustlock-${{ matrix.variant }}-${{ matrix.distro }}
           path: target/release/rustlock
 
+  release-build-arm64:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - variant: "default"
+            args: ""
+            target: "aarch64-unknown-linux-gnu"
+          - variant: "no-networking"
+            args: "--no-default-features"
+            target: "aarch64-unknown-linux-gnu"
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Install cross-compilation toolchain
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y \
+            curl \
+            llvm clang libclang-dev \
+            pkg-config \
+            libglib2.0-dev libcairo2-dev libpango1.0-dev libatk1.0-dev \
+            libgdk-pixbuf-2.0-dev libpam0g-dev libdbus-1-dev \
+            libwayland-dev libxkbcommon-dev \
+            gcc-aarch64-linux-gnu g++-aarch64-linux-gnu
+
+      - name: Add ARM target
+        run: rustup target add aarch64-unknown-linux-gnu
+
+      - name: Configure cross-compilation linker
+        run: |
+          mkdir -p ~/.cargo
+          echo '[target.aarch64-unknown-linux-gnu]
+          linker = "aarch64-linux-gnu-gcc"' >> ~/.cargo/config.toml
+
+      - name: Build ${{ matrix.variant }} (ARM64)
+        run: cargo build --release --target aarch64-unknown-linux-gnu ${{ matrix.args }}
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@v7
+        with:
+          name: rustlock-${{ matrix.variant }}-arm64
+          path: target/aarch64-unknown-linux-gnu/release/rustlock
+
+  publish-crates:
+    runs-on: ubuntu-latest
+    needs: [release-build-x86]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Publish to crates.io
+        env:
+          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
+        run: cargo publish
+
   release:
     runs-on: ubuntu-latest
-    needs: [release-build]
+    needs: [release-build-x86, release-build-arm64, publish-crates]
     permissions:
       contents: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
 
       - name: Download all artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           path: artifacts
 
+      - name: Generate checksums
+        working-directory: artifacts
+        run: |
+          find . -type f -name "rustlock" -exec sha256sum {} \; > SHA256SUMS.txt
+          cat SHA256SUMS.txt
+
+      - name: Import GPG key
+        id: import_gpg
+        uses: crazy-max/ghaction-import-gpg@v7
+        with:
+          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
+          passphrase: ${{ secrets.GPG_PASSPHRASE }}
+          git_config_global: true
+          git_user_name: JorySeverijnse
+          git_user_email: jory@severijnse.com
+
+      - name: Sign checksums
+        working-directory: artifacts
+        run: |
+          gpg --armor --detach-sign SHA256SUMS.txt
+
       - name: Determine tag
         id: tag
         run: echo "VERSION=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT
 
       - name: Create Release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@v3
         with:
           tag_name: ${{ github.ref_name }}
           name: RustLock v${{ steps.tag.outputs.VERSION }}
@@ -111,3 +198,8 @@ jobs:
             artifacts/rustlock-default-debian/rustlock
             artifacts/rustlock-default-fedora/rustlock
             artifacts/rustlock-default-arch/rustlock
+            artifacts/rustlock-default-arm64/rustlock
+            artifacts/rustlock-no-networking-arm64/rustlock
+            artifacts/SHA256SUMS.txt
+            artifacts/SHA256SUMS.txt.asc
+          generate_release_notes: true