71a4e1e88f
Node 20 reached end of life on 2026-04-30. check-frontend.yml, audit.yml and release.yml now install Node.js 24 through NodeSource's setup_24.x, as check-rust.yml has done since #375. Each step still prints `node --version` in the job log. The concurrency comment of check-rust.yml claimed the key cancels obsolete runs on force-push. la-compagnie-maximus docs/forgejo-ops.md measured the opposite on Forgejo 8.0.3: no pull_request run was cancelled by a later one, and push runs are cancelled without the key. The comment now states that measurement; the keys stay (harmless, meaningful where honoured), and check-frontend.yml and audit.yml point to it. release.yml names the trust it places in NodeSource: the script runs as root in the job container, whose Node.js then runs `npx tauri build` with TAURI_SIGNING_PRIVATE_KEY. Kept on purpose, also documented in docs/architecture.md, whose release.yml section described two jobs (windows-latest, ubuntu-22.04) where there is one containerised job cross-compiling Windows with cargo-xwin. release.yml only runs on a tag, so Node 24 there is proven at the next release: the /release skill now reads `node --version` from the release run's log (step 9), and STATE.md lists it under the checks due at the next release. No CHANGELOG entry: CI only. Resolves #376 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
67 lines
2.4 KiB
YAML
67 lines
2.4 KiB
YAML
name: Security audit
|
|
|
|
# Daily RustSec coverage (#232).
|
|
#
|
|
# check-rust.yml runs on PRs that change src-tauri/ and once a week on main,
|
|
# and its cargo audit step never fails the job — without this workflow a new
|
|
# advisory published against an unchanged dependency would go unnoticed.
|
|
#
|
|
# Runs without a Rust toolchain: cargo-audit only reads Cargo.lock, so the
|
|
# binary is invoked directly instead of as a `cargo` subcommand. That keeps
|
|
# this to ~1 min, where a daily check-rust would hold the capacity-1 runner
|
|
# for several minutes.
|
|
#
|
|
# Note: PATH is deliberately NOT overridden at job level (unlike check-rust,
|
|
# which needs /root/.cargo/bin for the toolchain) so that the install dir
|
|
# taiki-e/install-action appends to $GITHUB_PATH stays effective.
|
|
#
|
|
# This job reads .cargo/audit.toml from the checkout root, which lists the
|
|
# advisories accepted for this project (#310). A green run therefore means "no
|
|
# advisory outside that list", not "no advisory at all" — the justification and
|
|
# the removal criteria for each entry live in that file, and the policy behind
|
|
# it in docs/adr/0018-suppression-advisories-non-atteignables.md.
|
|
|
|
on:
|
|
schedule:
|
|
# 06:00 UTC daily
|
|
- cron: '0 6 * * *'
|
|
workflow_dispatch:
|
|
|
|
# What this key does on Forgejo 8.0.3: see the comment on `concurrency` in
|
|
# check-rust.yml (#376).
|
|
concurrency:
|
|
group: ci-audit-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
audit:
|
|
runs-on: ubuntu
|
|
container: ubuntu:22.04
|
|
steps:
|
|
- name: Install Node.js 24
|
|
run: |
|
|
apt-get update
|
|
apt-get install -y --no-install-recommends \
|
|
curl ca-certificates git tar gzip
|
|
# Node.js is required by actions/checkout, a JavaScript action that
|
|
# needs `node` in the container PATH (taiki-e/install-action is a
|
|
# composite action).
|
|
curl -fsSL https://deb.nodesource.com/setup_24.x | bash -
|
|
apt-get install -y nodejs
|
|
node --version
|
|
|
|
- name: Checkout
|
|
uses: https://github.com/actions/checkout@v4
|
|
|
|
- name: Install cargo-audit
|
|
uses: https://github.com/taiki-e/install-action@v2
|
|
with:
|
|
tool: cargo-audit
|
|
|
|
# Unlike the PR run in check-rust.yml, this one is meant to fail loudly:
|
|
# it IS the notification channel for a newly published advisory.
|
|
- name: cargo audit
|
|
run: cargo-audit audit --file src-tauri/Cargo.lock
|