this repo has no description
build: replace cargo-audit with cargo-deny for comprehensive dependency checks
+125
-30
+2
-2
.github/workflows/nix.yml
+2
-2
.github/workflows/nix.yml
+100
.github/workflows/security-audit.yml
+100
.github/workflows/security-audit.yml
···
1
+
# Weekly check of cargo dependencies against the RustSec Advisory Database.
2
+
# Creates/updates a GitHub issue with the "security" label on failure,
3
+
# and auto-closes it when all advisories are resolved.
4
+
5
+
name: Security Audit
6
+
7
+
on:
8
+
schedule:
9
+
- cron: "43 14 * * 1"
10
+
workflow_dispatch:
11
+
12
+
concurrency:
13
+
group: security-audit
14
+
cancel-in-progress: true
15
+
16
+
jobs:
17
+
audit:
18
+
name: Advisory Check
19
+
runs-on: ubuntu-latest
20
+
if: github.repository_owner == 'arcuru'
21
+
permissions:
22
+
issues: write
23
+
contents: read
24
+
steps:
25
+
- name: Checkout
26
+
uses: actions/checkout@v4
27
+
28
+
- name: Install Nix
29
+
uses: DeterminateSystems/nix-installer-action@v12
30
+
31
+
- name: Nix Cache
32
+
uses: DeterminateSystems/magic-nix-cache-action@v7
33
+
34
+
- name: Check advisories
35
+
id: audit
36
+
run: |
37
+
set +e
38
+
OUTPUT=$(nix develop --command cargo deny check advisories 2>&1)
39
+
EXIT_CODE=$?
40
+
echo "$OUTPUT"
41
+
{
42
+
echo "output<<AUDIT_EOF"
43
+
echo "$OUTPUT"
44
+
echo "AUDIT_EOF"
45
+
} >> "$GITHUB_OUTPUT"
46
+
echo "exit_code=$EXIT_CODE" >> "$GITHUB_OUTPUT"
47
+
exit 0
48
+
49
+
- name: Find existing issue
50
+
id: find_issue
51
+
run: |
52
+
ISSUE_NUMBER=$(gh issue list --label security --state open --search "Security Advisory Alert" --json number --jq '.[0].number // empty')
53
+
echo "number=${ISSUE_NUMBER}" >> "$GITHUB_OUTPUT"
54
+
env:
55
+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
56
+
57
+
- name: Create or update issue on failure
58
+
if: steps.audit.outputs.exit_code != '0'
59
+
run: |
60
+
TITLE="Security Advisory Alert"
61
+
TIMESTAMP=$(date -u +%Y-%m-%dT%H:%M:%SZ)
62
+
BODY=$(cat <<'ISSUE_EOF'
63
+
## Security Advisory Found
64
+
65
+
`cargo deny check advisories` found active advisories in dependencies.
66
+
67
+
<details>
68
+
<summary>Full output</summary>
69
+
70
+
```
71
+
__AUDIT_OUTPUT__
72
+
```
73
+
74
+
</details>
75
+
76
+
**Action required:** Review the advisories above and update affected dependencies or add ignore entries to `deny.toml` if appropriate.
77
+
78
+
_Last checked: __TIMESTAMP___
79
+
ISSUE_EOF
80
+
)
81
+
BODY="${BODY//__TIMESTAMP__/$TIMESTAMP}"
82
+
BODY="${BODY//__AUDIT_OUTPUT__/$AUDIT_OUTPUT}"
83
+
84
+
if [ -n "$ISSUE_NUMBER" ]; then
85
+
gh issue edit "$ISSUE_NUMBER" --body "$BODY"
86
+
else
87
+
gh issue create --title "$TITLE" --body "$BODY" --label security
88
+
fi
89
+
env:
90
+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
91
+
AUDIT_OUTPUT: ${{ steps.audit.outputs.output }}
92
+
ISSUE_NUMBER: ${{ steps.find_issue.outputs.number }}
93
+
94
+
- name: Close issue on success
95
+
if: steps.audit.outputs.exit_code == '0' && steps.find_issue.outputs.number != ''
96
+
run: |
97
+
gh issue close "$ISSUE_NUMBER" --comment "All advisories resolved. Closing automatically."
98
+
env:
99
+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
100
+
ISSUE_NUMBER: ${{ steps.find_issue.outputs.number }}
+18
deny.toml
+18
deny.toml
-17
flake.lock
-17
flake.lock
···
1
1
{
2
2
"nodes": {
3
-
"advisory-db": {
4
-
"flake": false,
5
-
"locked": {
6
-
"lastModified": 1774590906,
7
-
"narHash": "sha256-tit8dEqdlNzGGDyV+veL47RKeG4Utp27nixn1U8tycg=",
8
-
"owner": "rustsec",
9
-
"repo": "advisory-db",
10
-
"rev": "d15c149a7d336aec8c187b640a262c5385cb68cb",
11
-
"type": "github"
12
-
},
13
-
"original": {
14
-
"owner": "rustsec",
15
-
"repo": "advisory-db",
16
-
"type": "github"
17
-
}
18
-
},
19
3
"crane": {
20
4
"locked": {
21
5
"lastModified": 1774313767,
···
90
74
},
91
75
"root": {
92
76
"inputs": {
93
-
"advisory-db": "advisory-db",
94
77
"crane": "crane",
95
78
"fenix": "fenix",
96
79
"flake-parts": "flake-parts",
+5
-11
flake.nix
+5
-11
flake.nix
···
15
15
inputs.rust-analyzer-src.follows = "";
16
16
};
17
17
18
-
advisory-db = {
19
-
# Rust dependency security advisories
20
-
url = "github:rustsec/advisory-db";
21
-
flake = false;
22
-
};
23
-
24
18
# Flake helper for better organization with modules.
25
19
flake-parts = {
26
20
url = "github:hercules-ci/flake-parts";
···
116
110
# Run tests with cargo-nextest
117
111
test = craneLib.cargoNextest commonArgs;
118
112
119
-
# Audit dependencies
120
-
# This only runs when Cargo.lock files change
121
-
audit = craneLib.cargoAudit (commonArgs
113
+
# Audit dependencies, check licenses, and detect duplicate crates
114
+
deny = craneLib.cargoDeny (commonArgs
122
115
// {
123
-
inherit (inputs) advisory-db;
116
+
# advisories excluded: needs network access (blocked by nix sandbox)
117
+
cargoDenyChecks = "bans licenses sources";
124
118
});
125
119
};
126
120
···
128
122
inherit cmprss;
129
123
# Build almost every package in checks, with exceptions:
130
124
# - coverage: It requires a full rebuild, and only needs to be run occasionally
131
-
inherit (self.packages.${system}) clippy doc fmt test audit;
125
+
inherit (self.packages.${system}) clippy doc fmt test deny;
132
126
};
133
127
134
128
# This also sets up `nix fmt` to run all formatters