ci(security): run cargo-deny on the desktop Tauri workspace - #29
Open
QuicksilverSlick wants to merge 1 commit into
Open
QuicksilverSlick wants to merge 1 commit into
QuicksilverSlick wants to merge 1 commit into
Conversation
desktop/src-tauri is excluded from the root workspace and has its own Cargo.lock, so the Security job never checked it. Vulnerable h2 and rtrb, a yanked chacha20 and the rustls advisory sat there unnoticed. - Add a second cargo-deny step with --manifest-path desktop/src-tauri (runs even if the root step fails, so both reports show). - Start the Security domain and gate on desktop-rust changes too, or a desktop-only lockfile change never runs it. - Ignore the 8 desktop unmaintained advisories that have no safe upgrade (audiopus_sys, mach, proc-macro-error, unic-*), with reasons. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
CI's Security job runs
cargo-deny checkagainst the root workspace only.desktop/src-tauriis excluded from that workspace and has its ownCargo.lock, so the app we actually ship to users was never checked. Vulnerable h2 and rtrb, a yanked chacha20, and the rustls advisory all sat there unnoticed._ci-security.yml: adds a second step,cargo-deny --manifest-path desktop/src-tauri/Cargo.toml check. It uses the rootdeny.tomland runs even if the root step fails (!cancelled()), so one run reports both workspaces.ci.yml: the Security domain and theSecuritygate now also start ondesktop-rustchanges. Without that, a desktop-only lockfile PR (like fix(deps): bump h2, rtrb and chacha20 in the desktop lockfile #28) never runs the check. This is the same condition Rust Lint already uses.deny.toml: ignores the 8 unmaintained advisories in the desktop tree that have no safe upgrade, with reasons. Triage details are in fix(deps): bump h2, rtrb and chacha20 in the desktop lockfile #28.opus0.3 (direct)user-idle0.6 (direct)Merge order: #27 and #28 first. On its own, this PR's Security job is expected to fail on rustls (#27), h2 and rtrb (#28). Once both are merged, rebase this branch or rerun the job.
This makes desktop behave like root: when a new RustSec advisory lands against a desktop dependency, main turns red without any code change.
Related issue
Follows #27 and #28. No existing issue found.
Testing
cargo-deny check(root): advisories, bans, licenses and sources all ok. The 8 new ignore IDs don't occur in the root tree, so root prints 8advisory-not-detectedwarnings. They are warnings only.cargo-deny --manifest-path desktop/src-tauri/Cargo.toml check: advisories, bans, licenses and sources all ok.mainalone, the desktop step fails with 3 vulnerabilities and 8 unmaintained, so the step does catch problems.🤖 Generated with Claude Code