Fix security audit result handling and trigger scope - #440
Merged
Conversation
Run cargo audit exactly once and derive the verdict from the JSON report rather than the process exit status. The previous logic treated any nonzero exit as "vulnerabilities detected", so a network or advisory database failure produced a misleading job summary. It also invoked cargo audit twice, making the outcome depend on which of the two runs failed, and redirected stderr into audit.json, which meant the report was not necessarily valid JSON. Warnings (unmaintained, yanked, unsound) are now emitted as workflow annotations, since cargo-audit prints nothing in JSON mode and the second invocation was previously the only thing surfacing them. The report is also uploaded as an artifact. Drop the paths filter from the pull_request trigger so every PR gets a consistent audit verdict. The job only binstalls a prebuilt cargo-audit and reads Cargo.lock, so it is inexpensive relative to the rest of CI, and an unfiltered trigger is a prerequisite for making this a required status check, as a path-filtered workflow reports no status at all. Add an explicit read-only permissions block and pin cargo-binstall to a commit SHA instead of tracking a mutable branch.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Derives the audit verdict from the cargo-audit JSON report instead of the process exit status, so tool and network failures are no longer reported as vulnerabilities. Also runs the audit on every PR, surfaces advisory warnings as annotations, and hardens the workflow permissions and action pinning.