Skip to content

v3.0.0 — supply-chain gate with a review ratchet

Marketplace
Marketplace

Choose a tag to compare

View all tags
@Booyaka101 Booyaka101 released this 19 Jul 11:43
· 17 commits to main since this release
v3.0.0
11c119b

rust-symbol-audit turns a Rust dependency bump into a capability-creep review you can actually gate on. On PRs that change Cargo.lock, it runs five checks per changed crate, merges them into one sticky PR comment, and — once you've signed a version off — only ever alarms again on the unreviewed delta.

The five lanes

  • Symbols — diffs the v0-demangled .rlib symbols and flags newly-referenced sensitive APIs (std::process::Command, TcpStream, std::fs, env::var, secret-ish names, reqwest/rustls…).
  • Compile-time surface — a new/changed build.rs, a switch to proc-macro = true, or a new links = native lib, and the comment shows the actual build-script diff. (Symbol-diffing is blind to compile-time code.)
  • Dependency tree — crates the bump newly pulls into your build.
  • Provenance (network) — crates.io publisher change, missing source repo, or yanked version.
  • Advisories (network) — known RustSec vulns for the new version via OSV.dev.

The ratchet — why you can leave it on

Sign a (crate, version) off once in .rust-symbol-audit/reviews.toml (the comment gives you a copy-paste snippet), and future audits stay green for it — so every red is genuinely new. A sign-off suppresses only the capability lanes; a later advisory or provenance change is never hidden by a stale review. That's what makes fail-on trustworthy enough to block merges.

Plus: Dependabot/Renovate auto-merge triage (recommendation output), an audit-report.json compliance-evidence artifact, and per-repo allow/ignore config.

Usage

- uses: booyaka101/rust-symbol-audit@v3
  with:
    github-token: ${{ secrets.GITHUB_TOKEN }}
    fail-on: "none"   # or critical/high/medium to block merges

Verification

test/run_local.sh → 46 passed, 0 failed — all five lanes, the ratchet, gating, the Dependabot recommendation, and the evidence report, offline (network lanes via mock crates.io/OSV responses + one real crates.io bump).

A triage gate, not a sandbox or a proof. It surfaces the realistic "this dependency's surface changed — look" case and is quiet enough to keep on. See the README's what it can and can't catch.

Full notes: CHANGELOG.md

Assets 2
Loading