chore(ci): replace use of EmbarkStudios/cargo-deny-action

.github/workflows/ci.yml

@@ -98,12 +98,13 @@ jobs:
       - name: Install just
         uses: extractions/setup-just@f8a3cce218d9f83db3a2ecd90e41ac3de6cdfd9b #v3
 
-      - name: Install cargo-llvm-cov and cargo-nextest
-        uses: taiki-e/install-action@c7eb1735f09259a5035e8e5d44b1406b1cddc0fb #v2.83.0
+      - name: Install cargo-llvm-cov, cargo-nextest and cargo-deny
+        uses: taiki-e/install-action@2ca9b94c269419b7b0c711c09d0b21c4e1d51145 #v2.83.1
         with:
           tool: |
             cargo-llvm-cov@0.8.4
             cargo-nextest@0.9.99
+            cargo-deny@0.20.2
 
       - name: Symlink node_modules
         run: ln -sf out/node_modules .
@@ -179,8 +180,10 @@ jobs:
             **/Cargo.toml
             .deny.toml
 
-      - uses: EmbarkStudios/cargo-deny-action@8f84122a46a358a27cb0625d85ad60ab436a1b87 #v2
+      - name: Run cargo-deny check
         if: github.event_name != 'pull_request' || steps.rust-deps.outputs.any_changed == 'true'
+        shell: bash
+        run: cargo deny check
 
       # out/pyenv contains a venv with absolute Python paths that break
       # across runs. out/build.ninja is regenerated by configure each time.

tools/minilints/src/main.rs

@@ -240,8 +240,7 @@ fn sveltekit_temp_file(path: &str) -> bool {
 }
 
 fn check_cargo_deny() -> Result<()> {
-    // Used by `fix:minilints` locally. CI uses EmbarkStudios/cargo-deny-action.
-    Command::run("cargo install cargo-deny@0.19.2")?;
+    Command::run("cargo install cargo-deny@0.20.2")?;
     Command::run("cargo deny check")?;
     Ok(())
 }