.forgejo/workflows/security.yml
# The watcher holger did not have.
#
# On 2026-06-14 a security review recorded `cargo audit` as clean: 0
# vulnerabilities. On 2026-09-11 the next review found 29 plus 18 warnings, and
# nothing in the repository had noticed in between, because nothing in the
# repository ever ran it. The advisories were not the problem; the absence of a
# watcher was.
#
# What this checks. The root workspace builds from crates.io in every checkout (holger's
# B7: the sibling patches live in estate/ only), so a lone clone resolves the whole graph:
# `cargo audit` reads Cargo.lock and `cargo deny check` (advisories, bans, licences,
# sources, policy in deny.toml) runs on `cargo metadata --locked`. The suite, fmt and
# clippy are ci.yml's (and `cargo xtask ci`'s, which runs `cargo deny` as its `deny` step).
#
# Forgejo (git.gunnar.rs) runs Actions from this directory. If Actions is not enabled
# for the repository, enable it in the repository settings — until then the file
# is documentation of an intent nothing enforces, which is the state this is
# meant to end.
name: security
on:
push:
branches: [main]
pull_request:
schedule:
# Advisories land on days nobody pushes. 06:00 UTC daily.
- cron: "0 6 * * *"
workflow_dispatch:
jobs:
advisories:
runs-on: docker
container:
image: rust:1.96-slim-bookworm
steps:
- uses: actions/checkout@v4
- name: install cargo-audit
run: |
apt-get update && apt-get install -y --no-install-recommends pkg-config libssl-dev
cargo install cargo-audit --locked --version ^0.21
- name: audit the committed lockfile
run: |
# The ignore list is .cargo/audit.toml, which cargo-audit reads on its own: the
# ids of deny.toml's [advisories] ignore (which carries each reason), held equal
# by xtask/tests/audit_follows_deny.rs (lane HOL-NCSC). No list here.
#
# `--deny warnings` is deliberately NOT passed. The graph carries
# unmaintained, unsound and yanked transitive crates that cannot be
# moved from this repository, and a gate that is red on day one is a
# gate people learn to skip. This fails on VULNERABILITIES; the step
# below keeps the maintenance warnings visible.
cargo audit --file Cargo.lock
deny:
runs-on: docker
container:
image: rust:1.96-slim-bookworm
steps:
- uses: actions/checkout@v4
- name: install cargo-deny
run: cargo install cargo-deny --locked --version ^0.19
- name: cargo deny (advisories, bans, licences, sources; policy in deny.toml)
run: cargo deny --locked check