ci(security): prebuilt cargo-audit binary, decouple from repo MSRV - #8
Merged
Merged
Conversation
The cargo-audit job compiled cargo-audit via `cargo install --version ^0.22`, which couples cargo-audit's climbing MSRV to the target repo's pinned toolchain. This fails both ways on MSRV-pinned repos: 0.22.x needs rustc >= 1.88 to build, while 0.21.x bundles a rustsec that cannot parse the CVSS-4.0 advisories now in the RustSec DB (the whole scan errors out). zetesis (rust-toolchain 1.85) hit exactly this. Install a prebuilt cargo-audit@0.22.2 binary via taiki-e/install-action instead (reusing harmonia's fleet-pinned SHA). The binary's rustsec parses CVSS 4.0 and its install is toolchain-independent, so every delegating repo is covered regardless of MSRV. Drop the now-pointless rust-cache step (nothing compiles). Pin the exact version: a DB-format bump is a deliberate, reviewed change. Fixes kanon#2385.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The reusable
security.ymlcargo-audit job compiled cargo-audit from source (cargo install cargo-audit --locked --version ^0.22), which couples cargo-audit's ever-climbing MSRV to each delegating repo's pinned toolchain. On an MSRV-pinned repo this fails both ways:0.22.xrequires rustc ≥ 1.88 to compile → install fails on a repo pinning e.g. 1.85;0.21.xinstalls but bundles a rustsec that cannot parse the CVSS-4.0 advisories now present in the RustSec DB → the entire scan errors (unsupported CVSS version: 4.0), independent of the repo's own dependencies.zetesis (
rust-toolchain1.85) hit exactly this during the 2026-07-07 library-repo fix pass.Change
Install a prebuilt
cargo-audit@0.22.2binary viataiki-e/install-action(reusing harmonia's fleet-pinned SHAc93ccc0 # v2.82.8) instead of building from source:cargo-auditable@0.7.4pinning philosophy);setup-rust-toolchainstays (lets a repo without a committed Cargo.lock generate one for the scan); therust-cachestep is dropped (nothing compiles now).This is the systemic fix behind the per-repo workaround applied to zetesis.
Fixes kanon#2385.