ci: add cargo-audit workflow (Phase 0 / Track C)

[hyperpolymath]

Summary

Adds a Cargo Audit CI workflow that runs cargo audit against the Rust workspace on every PR, every push to main, and weekly via cron. Catches CVEs in transitive dependencies of crates/typed-wasm-verify without waiting for dependabot.

Distinct from the existing cargo-verify job in e2e.yml — that one catches API breaks (build + test); this one catches security advisories. Different concern, different cadence (weekly cron means new advisories surface even on quiescent code).

Phase 0 / Track C

Lead deliverable from Track C ("audit-floor cleanup") in the production-path Phase 0 work — see docs/PRODUCTION-PATH.adoc §Phase 0 and the tracking issue #48.

Track C's other items (real tests/property/property_test.mjs, Security aspect dimension, proof-level regression tests) follow as separate PRs.

Verification

Local cargo audit --deny warnings exits 0: 0 vulnerabilities across 19 workspace dependencies. The --deny warnings flag escalates yanked-crate notices and unmaintained warnings to failures, so the gate isn't just "no critical CVEs" — it's "no advisories at all."

Design choices

• No third-party action. Uses cargo install cargo-audit --locked matching the existing cargo-verify pattern. Same trust model as the rest of the Rust CI, no extra SHA to pin.
• Cron at 04:17 UTC Monday. Off the typical hour boundary to avoid GH Actions cron contention. Weekly is the right cadence — daily would create noise on advisories that bounce.
• --deny warnings on by default. Stricter than the cargo-audit default. Trades occasional noisy failures (yanked crate, unmaintained dep) for catching slow-burn issues before they become CVEs.

Test plan

• Workflow runs on this PR and passes
• cargo audit actually scans the typed-wasm-verify crate (visible in the action log: "Scanning Cargo.lock for vulnerabilities (19 crate dependencies)")
• Weekly cron is scheduled (visible in repo Actions tab after merge)

Out of scope

• Track C's other items (property tests, Security aspect, proof-level regression tests) — separate PRs
• npm audit equivalent — Node deps are scoped to the parser (mid-Track-A-rewrite); not worth automating until the parser migration settles

---

Generated by Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 119 issues detected

Severity	Count
🔴 Critical	6
🟠 High	54
🟡 Medium	59

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Issue in quality.yml",
    "type": "missing_workflow",
    "file": "quality.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in security-policy.yml",
    "type": "missing_workflow",
    "file": "security-policy.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Action actions/upload-artifact@v4 needs attention",
    "type": "unpinned_action",
    "file": "release.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/download-artifact@v4 needs attention",
    "type": "unpinned_action",
    "file": "release.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "believe_me undermines formal verification (1 occurrences, CWE-704)",
    "type": "believe_me",
    "file": "/home/runner/work/typed-wasm/typed-wasm/src/abi/TypedWasm/ABI/SessionProtocol.idr",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "assert_total bypasses totality checker (1 occurrences, CWE-704)",
    "type": "assert_total",
    "file": "/home/runner/work/typed-wasm/typed-wasm/src/abi/TypedWasm/ABI/SessionProtocol.idr",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "believe_me undermines formal verification (1 occurrences, CWE-704)",
    "type": "believe_me",
    "file": "/home/runner/work/typed-wasm/typed-wasm/src/abi/TypedWasm/ABI/Echo.idr",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "assert_total bypasses totality checker (1 occurrences, CWE-704)",
    "type": "assert_total",
    "file": "/home/runner/work/typed-wasm/typed-wasm/src/abi/TypedWasm/ABI/Echo.idr",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "believe_me undermines formal verification (1 occurrences, CWE-704)",
    "type": "believe_me",
    "file": "/home/runner/work/typed-wasm/typed-wasm/src/abi/TypedWasm/ABI/ResourceCapabilities.idr",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence