Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add audit job to security.yml #46

Closed
wants to merge 8 commits into from
Closed

Add audit job to security.yml #46

Changes from 6 commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
4736776
Add `audit` job to security.yml
andresuribe87 Dec 8, 2023
717fe5b
Use the audit-check action
andresuribe87 Dec 8, 2023
d7ef443
Why wont you run?
andresuribe87 Dec 8, 2023
95ff770
add a name
andresuribe87 Dec 8, 2023
072ddbe
Perhaps `audit` is not allowed
andresuribe87 Dec 8, 2023
838440b
Move to CI
andresuribe87 Dec 8, 2023
e1094a0
The latest
andresuribe87 Dec 8, 2023
82749d4
Make it work for forked repo prs
andresuribe87 Dec 8, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,15 @@ jobs:
- uses: actions/checkout@v3
- name: Run Clippy
run: cargo clippy --workspace
cargo_audit:
name: cargo audit
runs-on: ubuntu-latest

steps:
- uses: actions/checkout@v4
- uses: actions-rs/[email protected]
with:
token: ${{ secrets.GITHUB_TOKEN }}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Q: why are you importing this action vs running a simple cargo audit?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since this action requires access to GITHUB_TOKEN, forked prs will fail this check

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, that's correct. It's a known limitation from the https://github.com/rustsec/audit-check#limitations

But it's a great point. I've modified it now to run manually.

Copy link
Contributor

@leordev leordev Dec 8, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oh, I just read from their readme that they fallback to the console if its a forked PR, so no problem if you want to use their action and get the nice PR comments in our regular maintainers PRs.

(Sorry for the back and forth 🥺)

test:
name: cargo test
strategy:
Expand Down
Loading