ci: replace cargo-audit with cargo-deny advisories - #694
Merged
Conversation
The Audit workflow had been failing on RUSTSEC-2026-0235 (rkyv), which cargo-audit reads out of Cargo.lock even though no enabled feature activates the crate -- `cargo tree -i rkyv` is empty. cargo-deny resolves the actual feature graph, so it never sees rkyv; 87 of 770 lockfile crates are likewise excluded. Advisories move into the cargo-deny job, restricted to vulnerabilities. Informational advisories (unmaintained, unsound, notice) are transitive crates we do not pick, usually with no patched version, and GHSA omits them so Dependabot never raises them either. That retires the hand-maintained suppression list in .cargo/audit.toml, which had gone stale. Dependabot stays the primary alerting and auto-fix channel but cannot replace this check: 33% of 2026 RustSec vulnerabilities have no GHSA counterpart, including RUSTSEC-2026-0188, the wasmtime-wasi FilePerms bypass fixed here in 5dc868f and still absent from GHSA six weeks on. deny.toml is refreshed following dfinity/candid#757: per-section rationale, and the entries inherited from the deprecated sdk repo that no longer hold are gone -- allow-git for agent-rs, since the graph contains no git dependency at all, and the unused OpenSSL and Unicode-DFS-2016 licenses. The workflow is renamed off "license check" as it no longer only checks licenses, drops the apt provisioning cargo-deny has no use for, and runs weekly rather than daily: with 2-17 PRs merged per week and pull_request left unfiltered, the cron only has to cover quiet weeks. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The array indentation followed candid's four spaces; taplo.toml wants two. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Replaces cargo-audit with unified cargo-deny dependency-policy enforcement.
Changes:
- Adds advisory checks to the cargo-deny workflow.
- Refreshes license, ban, graph, and source policies.
- Removes obsolete audit workflow and configuration.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
deny.toml |
Defines consolidated dependency policies. |
.github/workflows/dependencies.yml |
Adds unified cargo-deny CI checks. |
.github/workflows/deny.yml |
Removes the superseded license workflow. |
.github/workflows/audit.yml |
Removes the cargo-audit workflow. |
.cargo/audit.toml |
Removes obsolete advisory exclusions. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
lwshang
marked this pull request as ready for review
August 5, 2026 20:11
lwshang
enabled auto-merge (squash)
August 5, 2026 20:11
This was referenced Aug 5, 2026
adamspofford-dfinity
approved these changes
Aug 5, 2026
raymondk
approved these changes
Aug 5, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Replaces the Audit workflow, red since RUSTSEC-2026-0235 flagged rkyv — a crate no enabled feature activates. cargo-deny resolves the real feature graph, so advisories move there, vulnerabilities only; informational advisories are noise Dependabot never raises either.
deny.tomlis refreshed following dfinity/candid#757, dropping the stale sdk-era entries. Reasoning is in the commit message and in the files.Note:
audit:requiredwas never actually a required check.dependencies:requiredneeds adding to the main ruleset if it should gate.🤖 Generated with Claude Code