d1d025df8d
Review follow-ups of PR #414. - audit.yml points to the concurrency comment of check-rust.yml, whose measurement covers push and pull_request runs only: say this workflow runs on schedule and workflow_dispatch, which it does not cover. - reportService.test.ts said CI runs Node 20, so no node:sqlite; CI runs Node 24 since #376, and the harness itself is #392's. - The release skill said /actions/tasks ignores `limit`. Measured 2026-10-12: only without `page` (613 rows); with `page` it pages by 30 or by `limit`. Refs #376 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
69 lines
2.5 KiB
YAML
69 lines
2.5 KiB
YAML
name: Security audit
|
|
|
|
# Daily RustSec coverage (#232).
|
|
#
|
|
# check-rust.yml runs on PRs that change src-tauri/ and once a week on main,
|
|
# and its cargo audit step never fails the job — without this workflow a new
|
|
# advisory published against an unchanged dependency would go unnoticed.
|
|
#
|
|
# Runs without a Rust toolchain: cargo-audit only reads Cargo.lock, so the
|
|
# binary is invoked directly instead of as a `cargo` subcommand. That keeps
|
|
# this to ~1 min, where a daily check-rust would hold the capacity-1 runner
|
|
# for several minutes.
|
|
#
|
|
# Note: PATH is deliberately NOT overridden at job level (unlike check-rust,
|
|
# which needs /root/.cargo/bin for the toolchain) so that the install dir
|
|
# taiki-e/install-action appends to $GITHUB_PATH stays effective.
|
|
#
|
|
# This job reads .cargo/audit.toml from the checkout root, which lists the
|
|
# advisories accepted for this project (#310). A green run therefore means "no
|
|
# advisory outside that list", not "no advisory at all" — the justification and
|
|
# the removal criteria for each entry live in that file, and the policy behind
|
|
# it in docs/adr/0018-suppression-advisories-non-atteignables.md.
|
|
|
|
on:
|
|
schedule:
|
|
# 06:00 UTC daily
|
|
- cron: '0 6 * * *'
|
|
workflow_dispatch:
|
|
|
|
# What this key does on Forgejo 8.0.3: see the comment on `concurrency` in
|
|
# check-rust.yml (#376). That measurement covers push and pull_request runs;
|
|
# this workflow only runs on schedule and workflow_dispatch, which it does
|
|
# not cover.
|
|
concurrency:
|
|
group: ci-audit-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
audit:
|
|
runs-on: ubuntu
|
|
container: ubuntu:22.04
|
|
steps:
|
|
- name: Install Node.js 24
|
|
run: |
|
|
apt-get update
|
|
apt-get install -y --no-install-recommends \
|
|
curl ca-certificates git tar gzip
|
|
# Node.js is required by actions/checkout, a JavaScript action that
|
|
# needs `node` in the container PATH (taiki-e/install-action is a
|
|
# composite action).
|
|
curl -fsSL https://deb.nodesource.com/setup_24.x | bash -
|
|
apt-get install -y nodejs
|
|
node --version
|
|
|
|
- name: Checkout
|
|
uses: https://github.com/actions/checkout@v4
|
|
|
|
- name: Install cargo-audit
|
|
uses: https://github.com/taiki-e/install-action@v2
|
|
with:
|
|
tool: cargo-audit
|
|
|
|
# Unlike the PR run in check-rust.yml, this one is meant to fail loudly:
|
|
# it IS the notification channel for a newly published advisory.
|
|
- name: cargo audit
|
|
run: cargo-audit audit --file src-tauri/Cargo.lock
|