ci: refresh ALL Cargo lockfiles on dependabot PRs

Dependabot security updates bypass the grouped-updates config and
create per-directory PRs (one per Cargo.lock). This causes version
skew — e.g. rand gets bumped in bindings/ruby but stays old elsewhere,
breaking the build.

Fix by unconditionally refreshing all lockfiles whenever any Cargo
manifest or lockfile changes, rather than only the affected directory.

Ref: dependabot/dependabot-core#7547

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: anakrish

.github/workflows/dependabot-refresh-cargo-lockfiles.yml

@@ -41,7 +41,7 @@ jobs:
           cargo --version
           rustc --version
 
-      - name: Refresh affected Cargo lockfiles
+      - name: Refresh all Cargo lockfiles
         shell: bash
         run: |
           set -euo pipefail
@@ -56,31 +56,20 @@ jobs:
             exit 0
           fi
 
-          declare -A manifests=()
-          for path in "${changed_files[@]}"; do
-            case "$path" in
-              bindings/ffi/*)
-                manifests["bindings/ffi/Cargo.toml"]=1
-                ;;
-              bindings/java/*)
-                manifests["bindings/java/Cargo.toml"]=1
-                ;;
-              bindings/python/*)
-                manifests["bindings/python/Cargo.toml"]=1
-                ;;
-              bindings/ruby/*)
-                manifests["bindings/ruby/Cargo.toml"]=1
-                ;;
-              bindings/wasm/*)
-                manifests["bindings/wasm/Cargo.toml"]=1
-                ;;
-              *)
-                manifests["Cargo.toml"]=1
-                ;;
-            esac
-          done
-
-          for manifest in "${!manifests[@]}"; do
+          # Always refresh ALL lockfiles when any Cargo change is detected.
+          # Dependabot security updates bypass grouping and create per-directory
+          # PRs, causing version skew if we only refresh the affected directory.
+          # See: https://github.com/dependabot/dependabot-core/issues/7547
+          all_manifests=(
+            "Cargo.toml"
+            "bindings/ffi/Cargo.toml"
+            "bindings/java/Cargo.toml"
+            "bindings/python/Cargo.toml"
+            "bindings/ruby/Cargo.toml"
+            "bindings/wasm/Cargo.toml"
+          )
+
+          for manifest in "${all_manifests[@]}"; do
             echo "Refreshing lockfile for $manifest"
             cargo metadata \
               --config 'build.rustc="rustc"' \
@@ -91,16 +80,14 @@ jobs:
               --manifest-path "$manifest" > /dev/null
           done
 
-          if [[ -n "${manifests[Cargo.toml]+x}" ]]; then
-            echo "Refreshing lockfile for tests/ensure_no_std/Cargo.toml (thumbv7m-none-eabi)"
-            cargo metadata \
-              --config 'build.rustc="rustc"' \
-              --config 'build.rustc-wrapper=""' \
-              --config 'build.rustc-workspace-wrapper=""' \
-              --format-version 1 \
-              --manifest-path tests/ensure_no_std/Cargo.toml \
-              --filter-platform thumbv7m-none-eabi > /dev/null
-          fi
+          echo "Refreshing lockfile for tests/ensure_no_std/Cargo.toml (thumbv7m-none-eabi)"
+          cargo metadata \
+            --config 'build.rustc="rustc"' \
+            --config 'build.rustc-wrapper=""' \
+            --config 'build.rustc-workspace-wrapper=""' \
+            --format-version 1 \
+            --manifest-path tests/ensure_no_std/Cargo.toml \
+            --filter-platform thumbv7m-none-eabi > /dev/null
 
       - name: Commit lockfile refresh
         shell: bash