v3.1.0 — comment/manifest-dir/vet inputs + more

Feature round bundling five issues (all with tests; suite now 65 checks). Backward-compatible — new inputs default to prior behavior.

• comment input (#2) — comment: "false" = summary-only mode (job summary + outputs + fail-on still apply, PR comment skipped).
• manifest-dir input (#4) — audit a Cargo.lock outside the repo root (monorepos / non-root workspaces).
• cargo-vet interop (#5) — a supply-chain/audits.toml's certified versions are imported as review-ledger sign-offs (new vet input). cargo-vet users get the ratchet for free.
• New capability patterns (#1) — high tier now flags clipboard (arboard/copypasta), input capture / keylogging (rdev/enigo/GetAsyncKeyState/SetWindowsHookEx), and screen/camera/mic capture (scrap/xcap/nokhwa/cpal).
• crates.io links (#3) — crate names in the comment link to their crates.io page.

@v3 points here. Full notes: CHANGELOG.

v3.0.2 — clearer PR comment

Presentation polish: accurate verdict headline (names the crate + the real reason), a summary counts line, flagged crates first with clean ones collapsed, new → x.y.z for newly-added crates, and deduped/linked advisory IDs. @v3 points here.

v3.0.1 — fix newly-added-crate parsing

Bugfix. Newly-added dependency crates (empty old version in the lockdiff) were mis-parsed because IFS=$'\t' read collapses the consecutive tabs, so their build and advisory lanes were skipped. Now splits tabs manually. Found by the live smoke test; regression test added (suite now 48 checks). @v3 points here. See CHANGELOG.

v3.0.0 — supply-chain gate with a review ratchet

rust-symbol-audit turns a Rust dependency bump into a capability-creep review you can actually gate on. On PRs that change Cargo.lock, it runs five checks per changed crate, merges them into one sticky PR comment, and — once you've signed a version off — only ever alarms again on the unreviewed delta.

The five lanes

• Symbols — diffs the v0-demangled .rlib symbols and flags newly-referenced sensitive APIs (std::process::Command, TcpStream, std::fs, env::var, secret-ish names, reqwest/rustls…).
• Compile-time surface — a new/changed build.rs, a switch to proc-macro = true, or a new links = native lib, and the comment shows the actual build-script diff. (Symbol-diffing is blind to compile-time code.)
• Dependency tree — crates the bump newly pulls into your build.
• Provenance (network) — crates.io publisher change, missing source repo, or yanked version.
• Advisories (network) — known RustSec vulns for the new version via OSV.dev.

The ratchet — why you can leave it on

Sign a (crate, version) off once in .rust-symbol-audit/reviews.toml (the comment gives you a copy-paste snippet), and future audits stay green for it — so every red is genuinely new. A sign-off suppresses only the capability lanes; a later advisory or provenance change is never hidden by a stale review. That's what makes fail-on trustworthy enough to block merges.

Plus: Dependabot/Renovate auto-merge triage (recommendation output), an audit-report.json compliance-evidence artifact, and per-repo allow/ignore config.

Usage

- uses: booyaka101/rust-symbol-audit@v3
  with:
    github-token: ${{ secrets.GITHUB_TOKEN }}
    fail-on: "none"   # or critical/high/medium to block merges

Verification

test/run_local.sh → 46 passed, 0 failed — all five lanes, the ratchet, gating, the Dependabot recommendation, and the evidence report, offline (network lanes via mock crates.io/OSV responses + one real crates.io bump).

A triage gate, not a sandbox or a proof. It surfaces the realistic "this dependency's surface changed — look" case and is quiet enough to keep on. See the README's what it can and can't catch.

Full notes: CHANGELOG.md

v2.0.0 — three-lane capability-creep triage gate

Adds two detection lanes beyond symbol-diffing: a compile-time surface lane (new/changed build.rs, proc-macro transition, native links =) and a dependency-tree diff. Plus a sticky PR comment, opt-in fail-on merge gating, a .rust-symbol-audit.toml allow/ignore config, and smarter max-crates. Local suite: 31 passed, 0 failed. See CHANGELOG. Superseded by v3.0.0.

v1.0.0 — v0-demangled Rust symbol diff

First release. On dependency-change PRs, diffs the v0-demangled Rust symbols between old and new crate versions in Cargo.lock and flags newly-gained sensitive capabilities (exec, sockets, fs, secrets, net) as a PR comment. Local suite: 17 passed, 0 failed. Superseded by v3.0.0.