From 66a37abd494dab82bb2839099b12b0e7288c98f6 Mon Sep 17 00:00:00 2001 From: Baptiste Parmantier Date: Tue, 22 Sep 2026 11:12:51 +0200 Subject: [PATCH] ci(workflow): gate the build on cargo audit Refs #220 --- .github/workflows/ci.yaml | 47 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 47 insertions(+) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 07e10293..e7db3a5f 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -46,3 +46,50 @@ jobs: - uses: Swatinem/rust-cache@v2 - name: Run tests run: cargo test --workspace + + audit: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - uses: dtolnay/rust-toolchain@stable + - uses: Swatinem/rust-cache@v2 + - name: Install cargo-audit + run: cargo install cargo-audit --locked + # Blocking on any advisory not listed below — a newly introduced + # vulnerability fails this job. Every `--ignore` is a pre-existing + # transitive-dependency advisory tolerated today because the fix is a + # dependency version bump, and version bumps for the published + # `rustmotion` crate are being handled separately from this workstream + # (crates/rustmotion/Cargo.toml, orchestrator-owned). Unmaintained/ + # unsound/yanked advisories (17 as of 2026-09-22) print but do not fail + # the job — that's `cargo audit`'s own default, left unchanged here. + # + # Review by 2026-12-22, or sooner once the dependency bumps land: + # RUSTSEC-2025-0008 — openh264-sys2 0.6.6, heap overflow in decoding. + # Direct dependency of the published `rustmotion` crate. Fix: openh264 >=0.8.0. + # RUSTSEC-2026-0204 — crossbeam-epoch 0.9.18, invalid pointer deref in `fmt::Pointer`. + # Via rayon-core <- exr <- image, reaches rustmotion-core/-components. Fix: >=0.9.20. + # RUSTSEC-2026-0195, RUSTSEC-2026-0194 — quick-xml 0.38.4 / 0.39.4, DoS + quadratic runtime. + # 0.38.4 via syntect reaches the published crates; 0.39.4 via dioxus-desktop/rfd is + # rustmotion-studio-only (Linux/Wayland file dialogs). Fix: >=0.41.0. + # RUSTSEC-2026-0285 — rustls 0.23.37, TLS 1.3 handshake level-boundary bug. + # Via ureq, used by rustmotion/rustmotion-core for Google Fonts + Iconify fetches. Fix: >=0.23.45. + # RUSTSEC-2026-0104, RUSTSEC-2026-0098, RUSTSEC-2026-0099, RUSTSEC-2026-0049 — rustls-webpki + # 0.103.9, four CRL/name-constraint parsing bugs. Same ureq path as rustls above. + # Fix: >=0.103.13,<0.104.0-alpha.1 (or the matching 0.104 alpha per advisory). + # RUSTSEC-2026-0257 — webbrowser 1.2.1, BROWSER env argument injection on Unix. + # Via dioxus-desktop, rustmotion-studio only (`publish = false`, never reaches a published + # crate). Fix: >=1.2.2. + - name: Audit dependencies + run: > + cargo audit + --ignore RUSTSEC-2025-0008 + --ignore RUSTSEC-2026-0204 + --ignore RUSTSEC-2026-0195 + --ignore RUSTSEC-2026-0194 + --ignore RUSTSEC-2026-0285 + --ignore RUSTSEC-2026-0104 + --ignore RUSTSEC-2026-0098 + --ignore RUSTSEC-2026-0099 + --ignore RUSTSEC-2026-0049 + --ignore RUSTSEC-2026-0257