From 517fc0d88ca7c4f834bee8f65c460f90660b2d27 Mon Sep 17 00:00:00 2001 From: admin Date: Tue, 7 Jul 2026 08:47:15 -0500 Subject: [PATCH] ci(security): install cargo-audit as a prebuilt binary, not from source The cargo-audit job compiled cargo-audit via `cargo install --version ^0.22`, which couples cargo-audit's climbing MSRV to the target repo's pinned toolchain. This fails both ways on MSRV-pinned repos: 0.22.x needs rustc >= 1.88 to build, while 0.21.x bundles a rustsec that cannot parse the CVSS-4.0 advisories now in the RustSec DB (the whole scan errors out). zetesis (rust-toolchain 1.85) hit exactly this. Install a prebuilt cargo-audit@0.22.2 binary via taiki-e/install-action instead (reusing harmonia's fleet-pinned SHA). The binary's rustsec parses CVSS 4.0 and its install is toolchain-independent, so every delegating repo is covered regardless of MSRV. Drop the now-pointless rust-cache step (nothing compiles). Pin the exact version: a DB-format bump is a deliberate, reviewed change. Fixes kanon#2385. --- .github/workflows/security.yml | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-) diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 05ce56c..eb8fc01 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -96,14 +96,21 @@ jobs: git config --global credential.helper store printf 'https://forkwright:%s@github.com\n' "${FLEET_REPO_TOKEN}" > ~/.git-credentials chmod 0600 ~/.git-credentials - # WHY: setup-rust-toolchain auto-reads rust-toolchain.toml, so nightly-pinned - # repos (theatron) get nightly and stable repos get stable with no input. + # WHY: setup-rust-toolchain auto-reads rust-toolchain.toml so a repo without + # a committed Cargo.lock can still generate one for the scan; MSRV-pinned + # repos get their pinned rustc, which no longer constrains cargo-audit now + # that it is installed as a prebuilt binary below. - uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6 # v1.16.1 - - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 + # WHY: install cargo-audit as a PREBUILT binary, not `cargo install` from + # source. A source build couples cargo-audit's climbing MSRV to the target + # repo's pinned toolchain and fails both ways on MSRV-pinned repos: 0.22.x + # needs rustc >= 1.88 to compile, while 0.21.x bundles a rustsec that cannot + # parse the CVSS-4.0 advisories now in the RustSec DB (erroring the whole + # scan). Pin the exact version — a DB-format bump is a deliberate, reviewed + # change, never an implicit floor. See kanon#2385. + - uses: taiki-e/install-action@c93ccc03e00cd0e08e494f5fd058a6c55a6a1907 # v2.82.8 with: - key: cargo-audit - - name: Install cargo-audit - run: cargo install cargo-audit --locked --version ^0.22 + tool: cargo-audit@0.22.2 - name: cargo audit run: cargo audit --deny unmaintained --deny unsound --deny yanked