Repository navigation
ci: keep the advisories watched and the actions current - #41
Merged
Merged
Conversation
Dependabot alerts, secret scanning and code scanning are all off on this repository, so nothing was watching the dependency tree. A manual `cargo audit` over the 348 crates in the lockfile reports no vulnerabilities and two informational warnings, neither of which this repository can act on: lru's panic-safety fix landed in 0.18.2 while glyphon pins 0.16, and ttf-parser is unmaintained with no patched release. Both are named in the ignore list with the reason and the condition for removing them. The audit runs as its own job on Linux, since it only reads Cargo.lock. Dependabot is pointed at cargo and the actions, monthly, with the cargo updates grouped into one pull request. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Every run carries the annotation "Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/cache@v4, actions/checkout@v4". Both have majors that target Node 24, so checkout moves to v7 and cache to v6, in CI and in the release workflow. dtolnay/rust-toolchain is a composite action with no Node runtime and is left as it is. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
tkc
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two things, both about what CI depends on.
1. Nothing was watching the dependency tree
Asked to apply all security updates, I went looking for the alerts first. There are none, because nothing is looking:
So the lockfile had to be checked by hand.
cargo auditover the 348 crates reports 0 vulnerabilities and 2 informational warnings:lru0.16.4>= 0.18.2, butglyphon0.12 pinslru = "0.16.2". The advisory needs a key type whoseDroppanics insidecatch_unwind; glyphon's key isGlyphonCacheKey, aCopyenum, and aCopytype cannot implementDrop. The path does not exist here.ttf-parser0.25.1cosmic-text→fontdb. The author has stopped maintaining it;patched = [], so there is no version to move to.Both arrive under
glyphon, and both leave when glyphon moves. Nothing to update, in other words — which is worth stating plainly rather than reporting a clean bill of health.This adds a
cargo auditjob, running on Linux because it only readsCargo.lock. The two advisories are named inignore:with the reason and the condition for removing each, so the job stays quiet until something new appears..github/dependabot.ymlpoints Dependabot at cargo and at the actions, monthly, with the cargo updates grouped into a single pull request so the noise stays at one PR a month.2. Every run has been warning about the action runtime
checkoutmoves to v7 andcacheto v6, in CI and in the release workflow.dtolnay/rust-toolchainis a composite action with no Node runtime and is left as it is.What this cannot change
Dependabot alerts and secret scanning are repository settings, not files. They are still off. One click each under Settings → Code security, and I would turn on both.
🤖 Generated with Claude Code