f4b09b028e
cargo update -p rustls-webpki -p tar moves rustls-webpki 0.103.9 -> 0.103.13 and tar 0.4.44 -> 0.4.46, both within the existing Cargo.toml bounds. They sit under tauri-plugin-updater, which downloads and unpacks application updates, so all six of their advisories were reachable in the shipped binary. The remaining three can neither be fixed nor reached. quick-xml (2x 7.5 high) is pulled by plist, which tauri only needs for Apple bundling: its per-target trees are empty for both shipped targets and it appears solely under x86_64-apple-darwin. Its fix is >= 0.41.0 while plist requires ^0.38, a semver-incompatible boundary [patch.crates-io] cannot cross. rsa has no published fix at all and is never compiled — its only parent is sqlx-mysql, an artifact of sqlx's multi-backend graph on a SQLite project. Leaving those three to red the daily gate forever would reproduce the signal loss that #232 removed the `|| true` to fix, so they move into a versioned .cargo/audit.toml. Entries are keyed by advisory ID, never by crate, so a new advisory against the same crate still reds the gate; each carries its reachability proof and its removal condition. A blocking step in check-rust.yml re-proves that justification on every PR touching src-tauri/ or .cargo/, and fails if a suppressed crate enters a shipped target's graph — the scenario that would rot the list is itself a src-tauri change. It separates cargo tree's exit status from its output (an absent crate and a failed invocation both print nothing) and asserts a canary crate is still found, so its silence proves something. cargo audit: 9 vulnerabilities -> 0, warnings unchanged at 23 (cargo-audit 0.22.2, advisory-db 0bfde9d6 of 2026-07-27). cargo check + cargo test green (106 tests); npm build + 871 vitest green. Resolves #310 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
64 lines
2.2 KiB
YAML
64 lines
2.2 KiB
YAML
name: Security audit
|
|
|
|
# Daily RustSec coverage (#232).
|
|
#
|
|
# check-rust.yml only runs when src-tauri/ changes, which is roughly 1 PR in
|
|
# 40 — without this workflow a new advisory published against an unchanged
|
|
# dependency would go unnoticed for weeks.
|
|
#
|
|
# Runs without a Rust toolchain: cargo-audit only reads Cargo.lock, so the
|
|
# binary is invoked directly instead of as a `cargo` subcommand. That keeps
|
|
# this to ~1-2 min rather than the ~22 min a scheduled check-rust would cost
|
|
# every day on a capacity-1 runner.
|
|
#
|
|
# Note: PATH is deliberately NOT overridden at job level (unlike check-rust,
|
|
# which needs /root/.cargo/bin for the toolchain) so that the install dir
|
|
# taiki-e/install-action appends to $GITHUB_PATH stays effective.
|
|
#
|
|
# This job reads .cargo/audit.toml from the checkout root, which lists the
|
|
# advisories accepted for this project (#310). A green run therefore means "no
|
|
# advisory outside that list", not "no advisory at all" — the justification and
|
|
# the removal criteria for each entry live in that file, and the policy behind
|
|
# it in docs/adr/0018-suppression-advisories-non-atteignables.md.
|
|
|
|
on:
|
|
schedule:
|
|
# 06:00 UTC daily
|
|
- cron: '0 6 * * *'
|
|
workflow_dispatch:
|
|
|
|
concurrency:
|
|
group: ci-audit-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
audit:
|
|
runs-on: ubuntu
|
|
container: ubuntu:22.04
|
|
steps:
|
|
- name: Install Node.js 20
|
|
run: |
|
|
apt-get update
|
|
apt-get install -y --no-install-recommends \
|
|
curl ca-certificates git tar gzip
|
|
# Node.js is required by actions/checkout and taiki-e/install-action
|
|
# (JavaScript actions need `node` in the container PATH).
|
|
curl -fsSL https://deb.nodesource.com/setup_20.x | bash -
|
|
apt-get install -y nodejs
|
|
node --version
|
|
|
|
- name: Checkout
|
|
uses: https://github.com/actions/checkout@v4
|
|
|
|
- name: Install cargo-audit
|
|
uses: https://github.com/taiki-e/install-action@v2
|
|
with:
|
|
tool: cargo-audit
|
|
|
|
# Unlike the PR run in check-rust.yml, this one is meant to fail loudly:
|
|
# it IS the notification channel for a newly published advisory.
|
|
- name: cargo audit
|
|
run: cargo-audit audit --file src-tauri/Cargo.lock
|