cf1da2bea0
The runner's cache server is reachable again since the VPS fix of 2026-10-03 (cache proxy pinned to port 28100, ufw rule scoped to the Docker job networks; diagnosed in #374). Bring caching back to check-rust through Swatinem/rust-cache, as #232 deferred. forgejo-runner v12.7.0 keeps what a pull_request run saves private to that PR, so PR runs alone would only warm later pushes to the same PR. A weekly scheduled run on main (Mondays 06:30 UTC) and workflow_dispatch write the shared entries that every PR falls back to. rust-cache v2.9+ declares node24 and the runner starts JavaScript actions with the container's node, so the job now installs Node.js 24. zstd is installed for faster, smaller cache archives. No npm cache in check-frontend, by decision: with per-PR isolation it would only serve later pushes of a PR, and npm ci takes 9s there. audit.yml loses two comments this change makes false. No CHANGELOG entry: CI configuration only. Refs #234 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
65 lines
2.3 KiB
YAML
65 lines
2.3 KiB
YAML
name: Security audit
|
|
|
|
# Daily RustSec coverage (#232).
|
|
#
|
|
# check-rust.yml runs on PRs that change src-tauri/ and once a week on main,
|
|
# and its cargo audit step never fails the job — without this workflow a new
|
|
# advisory published against an unchanged dependency would go unnoticed.
|
|
#
|
|
# Runs without a Rust toolchain: cargo-audit only reads Cargo.lock, so the
|
|
# binary is invoked directly instead of as a `cargo` subcommand. That keeps
|
|
# this to ~1 min, where a daily check-rust would hold the capacity-1 runner
|
|
# for several minutes.
|
|
#
|
|
# Note: PATH is deliberately NOT overridden at job level (unlike check-rust,
|
|
# which needs /root/.cargo/bin for the toolchain) so that the install dir
|
|
# taiki-e/install-action appends to $GITHUB_PATH stays effective.
|
|
#
|
|
# This job reads .cargo/audit.toml from the checkout root, which lists the
|
|
# advisories accepted for this project (#310). A green run therefore means "no
|
|
# advisory outside that list", not "no advisory at all" — the justification and
|
|
# the removal criteria for each entry live in that file, and the policy behind
|
|
# it in docs/adr/0018-suppression-advisories-non-atteignables.md.
|
|
|
|
on:
|
|
schedule:
|
|
# 06:00 UTC daily
|
|
- cron: '0 6 * * *'
|
|
workflow_dispatch:
|
|
|
|
concurrency:
|
|
group: ci-audit-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
audit:
|
|
runs-on: ubuntu
|
|
container: ubuntu:22.04
|
|
steps:
|
|
- name: Install Node.js 20
|
|
run: |
|
|
apt-get update
|
|
apt-get install -y --no-install-recommends \
|
|
curl ca-certificates git tar gzip
|
|
# Node.js is required by actions/checkout, a JavaScript action that
|
|
# needs `node` in the container PATH (taiki-e/install-action is a
|
|
# composite action).
|
|
curl -fsSL https://deb.nodesource.com/setup_20.x | bash -
|
|
apt-get install -y nodejs
|
|
node --version
|
|
|
|
- name: Checkout
|
|
uses: https://github.com/actions/checkout@v4
|
|
|
|
- name: Install cargo-audit
|
|
uses: https://github.com/taiki-e/install-action@v2
|
|
with:
|
|
tool: cargo-audit
|
|
|
|
# Unlike the PR run in check-rust.yml, this one is meant to fail loudly:
|
|
# it IS the notification channel for a newly published advisory.
|
|
- name: cargo audit
|
|
run: cargo-audit audit --file src-tauri/Cargo.lock
|