Repository navigation
Conversation
Clears RUSTSEC-2026-0382 and RUSTSEC-2026-0383, which failed the cargo audit job.
A weekly cron in ci.yml re-ran every job to reach the audit, so an advisory could wait days. security.yml now runs cargo audit daily and on demand, and the cron is gone. The lint job runs zizmor over the workflows, checkouts no longer persist credentials, and Dependabot waits seven days before proposing a release.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The weekly cron in ci.yml re-ran the whole matrix just to reach the audit, so an advisory could sit for days; the last two (RUSTSEC-2026-0382 and RUSTSEC-2026-0383) failed the audit job on a push instead. security.yml now runs cargo audit daily and on demand with the same flags as CI, the cron and its schedule guards are gone from ci.yml, and the first commit bumps rustls-webpki and webpki-root-certs to clear both advisories.
The lint job also runs zizmor over the workflows, every checkout stops persisting credentials, and Dependabot waits seven days before proposing a release (security updates ignore the cooldown). docs/development.md describes the new layout. Dependabot alerts and automated security fixes were also enabled in the repository settings.
Verified locally: cargo audit --deny warnings is clean, cargo test --all-targets --all-features passes, cargo build --all-features --locked passes on the 1.88.0 MSRV, and actionlint and zizmor report nothing. The zizmor step and the new workflow have not run on GitHub yet, so this PR is their first run. Left out: cargo-deny and an audit.toml, since there is no license policy or accepted advisory to encode.