rob thijssen
44d32b4432
Some checks failed
ci / gate (push) Has been cancelled
The rust gate builds and tests with --locked, so a change that would move Cargo.lock fails instead of resolving something new. A dependency policy step runs cargo deny check (licenses, advisories, bans, sources from deny.toml) and cargo machete, both now in the runner image (gongfoo bd936d3, images run 284). deps.yaml runs the advisory check daily on the rust runner, so an advisory published against a dependency the lockfile already pins turns red within a day whether or not anyone pushes. Closes #49 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014ftBXYuba8ARhQeF74oUgW
26 lines
717 B
YAML
26 lines
717 B
YAML
name: deps
|
|
|
|
# The advisory half of the dependency policy on a clock (#49). CI runs the
|
|
# full policy on every push; this runs the advisory check daily, so a
|
|
# RustSec advisory published against a dependency this repository already
|
|
# pins turns red within a day even when nobody pushes.
|
|
|
|
on:
|
|
schedule:
|
|
- cron: "17 5 * * *"
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
advisories:
|
|
# `rust`: cargo-deny ships in the image; no GTK is needed to read a
|
|
# lockfile against the advisory database.
|
|
runs-on: rust
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: advisories against the pinned lockfile
|
|
run: |
|
|
set -euo pipefail
|
|
cargo deny --version
|
|
cargo deny check advisories
|