chore: add dependency-review + cargo-audit + commitlint workflows by satyakwok · Pull Request #27 · Sentriscloud/indexer-rs

satyakwok · 2026-05-13T15:44:43Z

Why

Mirrors the supply-chain hygiene already running on `sentrix-labs/sentrix`. indexer-rs reads chain RPC + writes to Postgres / Redis / ClickHouse — compromised deps here would have direct write access to operator infra.

Per the repo hardening matrix (`research/02_repo_hardening_matrix.md`), this is HIGH priority. `gitleaks` already landed in #26; this PR closes the remaining hardening gaps.

What

`.github/workflows/dependency-review.yml` — blocks PRs introducing HIGH-severity vulns or licenses outside our allowlist (license list mirrors `deny.toml` for consistency).
`.github/workflows/cargo-audit.yml` — daily-scheduled + per-PR RustSec advisory scan. Catches new advisories against existing deps that `deny.toml` hasn't seen yet. Non-blocking warning for now (promote to blocking once backlog is clean).
`.github/workflows/commitlint.yml` + `.commitlintrc.json` — Conventional Commits on PR messages.

`cargo-deny` is already wired in `ci.yml`'s `deny` job — not duplicated.

Test plan

Open this PR → all three new workflows fire on the diff

Summary by CodeRabbit

Chores
- Enforced stricter commit message rules with a 100‑char header limit and constrained set of allowed types; body/footer line limits left unconstrained.
- Added CI check to lint commit messages on PRs.
- Added scheduled and on‑push vulnerability scanning that surfaces advisories as non‑blocking warnings.
- Added automated dependency and license review that blocks high‑severity issues and summarizes findings in PRs.

Mirrors the supply-chain hygiene already running on sentrix-labs/sentrix. indexer-rs reads chain RPC + writes to Postgres / Redis / ClickHouse; keeping the dep tree clean matters because compromised deps would have direct write access to operator infra. dependency-review: blocks PRs introducing HIGH-severity vulns or licenses outside our allowlist (mirrors deny.toml). cargo-audit: daily-scheduled + per-PR RustSec advisory scan. Catches new advisories against existing deps that deny.toml hasn't seen yet. Non-blocking warning for now; promote to blocking once backlog is clean. commitlint: enforces Conventional Commits on PR messages. cargo-deny is already wired in ci.yml's `deny` job — not duplicated.

coderabbitai · 2026-05-13T15:50:59Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: e3007e12-4723-4161-97b5-e1863abecc4d

📥 Commits

Reviewing files that changed from the base of the PR and between 6d96118 and bc5847e.

📒 Files selected for processing (1)

.github/workflows/cargo-audit.yml

📝 Walkthrough

Walkthrough

This PR adds CI checks and commit rules: a .commitlintrc.json file for commit message validation, a commitlint GitHub Actions workflow that runs on PRs to main, a dependency-review workflow that diffs dependency changes and enforces license/security policies on PRs, and a cargo-audit workflow that runs on PRs, pushes to main, on a daily schedule, and via manual dispatch while mapping cargo-audit exit codes to warnings vs. failures.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

Sentriscloud/sdk-rs#6: Pins GitHub Actions workflow uses: entries to specific commit SHAs for reproducibility, similar to the dependency-review action pinning in this PR.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the main changes: adding three workflows (dependency-review, cargo-audit, commitlint) for repository hardening.
Description check	✅ Passed	The description provides clear context (Why), detailed changes (What), and confirmation of testing (Test plan), though it does not follow the template structure with Scope and Deploy impact checkboxes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch chore/add-rust-supply-chain-hardening

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/cargo-audit.yml:
- Around line 41-45: Replace the current unconditional fallback ("cargo audit
... || echo ...") with a post-run exit-code check: run the cargo audit command
(with the same --ignore flags), capture its exit status ($?), and then if the
status is 1 emit the existing warning message (non-blocking advisories), but if
the status is 2 or greater re-exit the workflow with that code so execution
failures fail the job; keep the same ignored IDs and warning text and ensure the
shell step returns the captured exit code on error cases >=2.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: c4abe018-0872-4c42-9d71-13cf242e2325

📥 Commits

Reviewing files that changed from the base of the PR and between 96d3e89 and b05362e.

📒 Files selected for processing (4)

.commitlintrc.json
.github/workflows/cargo-audit.yml
.github/workflows/commitlint.yml
.github/workflows/dependency-review.yml

dependency-review-action requires GitHub Advanced Security on private repositories. indexer-rs is private (intentionally — auth surface still WIP per docs/INDEXER_RS_CREDS_AUTH.md), so the action errors with "Dependency review is not supported on this repository". Same scope already covered by: - cargo-deny (full-tree license + advisory + ban check on every push) - cargo-audit (daily-scheduled RustSec scan) - Dependabot alerts (auto-PRs for vulnerable deps) When indexer-rs flips public, the dep-review workflow can be added back without other changes.

This reverts commit 0561a3a.

The previous `|| echo` pattern converted ALL non-zero exits — including cargo-audit tool/runtime failures (network error, corrupt advisory db, etc) — into non-blocking warnings, indistinguishable from real findings on the PR check summary. cargo-audit exits 1 for findings (per RustSec Advisory Database) and 2+ for execution errors. Use case statement to surface the right signal: - exit 0 = no advisories (silent success) - exit 1 = findings (warning, non-blocking — backlog phase) - exit 2+ = execution failure (error, fails the job) Followup to CodeRabbit comment on PR #27.

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/cargo-audit.yml:
- Around line 8-10: Update the stale comment that still claims the job is
wrapped in "|| echo ::warning::" to reflect the actual explicit exit-code
branching logic now used later in the workflow; find the top comment that
mentions "|| echo ::warning::" and replace it with a concise note stating the
job uses explicit exit-code branching (see the conditional exit handling later
in the workflow) and instruct that the check can be promoted to a blocking
failure by removing the non-blocking branching once the backlog is cleared.
Ensure the updated comment references the explicit exit-code behavior rather
than the old shim so future maintainers aren't misled.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: c0e250c7-f2ad-48e2-bf8d-5e7d757a46b4

📥 Commits

Reviewing files that changed from the base of the PR and between b05362e and 3138ed0.

📒 Files selected for processing (1)

.github/workflows/cargo-audit.yml

The header still described the old `|| echo ::warning::` shim that swallowed all non-zero exits. The actual workflow now uses explicit exit-code branching (commit 3138ed0) — exit 1 = warning, exit 2+ = fail. Comment now matches. Followup to CodeRabbit comment on PR #27.

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/cargo-audit.yml:
- Around line 37-38: Update the "Install cargo-audit" CI step to pin cargo-audit
to a specific version for reproducible scans: replace the current install
invocation (cargo install cargo-audit --locked) with a version-pinned install
(use the --version flag, e.g. cargo install cargo-audit --locked --version
x.y.z) so the workflow always installs the explicit cargo-audit release; confirm
the chosen version and update any workflow docs if needed.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: ff8835d5-8567-4675-a97d-83ab054a869a

📥 Commits

Reviewing files that changed from the base of the PR and between 3138ed0 and 6d96118.

📒 Files selected for processing (1)

.github/workflows/cargo-audit.yml

The previous `cargo install cargo-audit --locked` pulled whatever was latest-stable at install time, which means a drift-by-default behaviour in a security-sensitive scan: a backwards-incompatible cargo-audit release could change which advisories fire (or how exit codes map) without anyone noticing until CI behaves differently. Pin via env-var so future bumps are intentional (PR diff visible) and matches the existing SHA-pin discipline applied to GitHub Actions in this workflow. Followup to CodeRabbit comment on PR #27. Version verified against crates.io API: 0.22.1 is the current max_stable.

coderabbitai Bot reviewed May 13, 2026

View reviewed changes

Comment thread .github/workflows/cargo-audit.yml Outdated

satyakwok added 3 commits May 13, 2026 18:18

Revert "chore(ci): drop dependency-review workflow"

c42f2b2

This reverts commit 0561a3a.

coderabbitai Bot reviewed May 13, 2026

View reviewed changes

Comment thread .github/workflows/cargo-audit.yml Outdated

coderabbitai Bot reviewed May 13, 2026

View reviewed changes

Comment thread .github/workflows/cargo-audit.yml Outdated

satyakwok merged commit 2dce881 into main May 13, 2026
8 checks passed

coderabbitai Bot mentioned this pull request May 14, 2026

fix(audit): close 9 leak/DoS findings from 2026-05-13 security review #30

Merged

5 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore: add dependency-review + cargo-audit + commitlint workflows#27

chore: add dependency-review + cargo-audit + commitlint workflows#27
satyakwok merged 6 commits into
mainfrom
chore/add-rust-supply-chain-hardening

satyakwok commented May 13, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented May 13, 2026 •

edited

Loading

Walkthrough

Estimated code review effort

Possibly related PRs

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

satyakwok commented May 13, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Why

What

Test plan

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented May 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Estimated code review effort

Possibly related PRs

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

satyakwok commented May 13, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented May 13, 2026 •

edited

Loading