ci(deny): add cargo-deny dependency audit workflow#61
Conversation
Add `deny.toml` and `.github/workflows/deny.yml` to run `cargo deny check all` on Cargo.lock changes. This checks for known security advisories, license compliance, banned crates, and trusted git sources. Also upgrades transitive dependencies to fix known vulnerabilities: - tar 0.4.44 → 0.4.45 (RUSTSEC-2026-0067, RUSTSEC-2026-0068) - rustls-webpki 0.103.9 → 0.103.10 (RUSTSEC-2026-0049) - tracing-subscriber 0.3.22 → 0.3.23 lru 0.12.x (RUSTSEC-2026-0002) is ignored — pinned by reth fork, fix requires semver-incompatible 0.16.3.
|
Important Review skippedReview was skipped due to path filters ⛔ Files ignored due to path filters (1)
CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
📝 WalkthroughWalkthroughAdds cargo-deny configuration and a GitHub Actions workflow to run Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (2)
.github/workflows/deny.yml (1)
6-8: Also trigger deny checks when policy changes.Current path filters only watch
Cargo.lock. Ifdeny.tomlchanges alone, CI won’t validate the new policy.Suggested patch
push: branches: [main] - paths: [Cargo.lock] + paths: [Cargo.lock, deny.toml] pull_request: - paths: [Cargo.lock] + paths: [Cargo.lock, deny.toml]🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/deny.yml around lines 6 - 8, The workflow currently only watches Cargo.lock (the two occurrences of paths: [Cargo.lock] under the push and pull_request triggers), so changes to deny.toml won't run the deny checks; update both trigger path lists to include "deny.toml" (e.g., change paths: [Cargo.lock] to paths: [Cargo.lock, deny.toml]) so policy updates also trigger the CI job.deny.toml (1)
6-14: Add GitHub issue links and review dates to tracked RustSec advisories.The three ignored advisories are well-rationalized but lack tracking metadata. While two (paste, bincode) are permanently unmaintained and one (lru) requires a semver-incompatible upgrade, adding linked issues and review dates would help track when these suppressions should be revisited. Use the existing GitHub Issues process documented in CONTRIBUTING.md to track remediation paths for each.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@deny.toml` around lines 6 - 14, The deny.toml ignore list currently suppresses three advisories ("RUSTSEC-2024-0436", "RUSTSEC-2025-0141", "RUSTSEC-2026-0002") but lacks tracking metadata; update deny.toml to append for each advisory an inline comment or structured metadata entry pointing to the corresponding GitHub issue URL(s) and a planned review date (e.g., YYYY-MM-DD) so each ignored advisory has a linked issue and a revisit date per the repository CONTRIBUTING.md process; ensure you reference the exact advisory strings ("RUSTSEC-2024-0436", "RUSTSEC-2025-0141", "RUSTSEC-2026-0002") when creating issues and include the issue numbers/URLs and review dates next to them.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/deny.yml:
- Around line 19-22: The workflow uses mutable tags "actions/checkout@v4" and
"EmbarkStudios/cargo-deny-action@v2"; replace those tag references with the
corresponding full 40-character commit SHAs (e.g., actions/checkout@<full_sha>
and EmbarkStudios/cargo-deny-action@<full_sha>) so the runner pins to immutable
commits—update the uses entries for actions/checkout and
EmbarkStudios/cargo-deny-action accordingly and verify the SHAs match the
intended release commits.
In `@deny.toml`:
- Around line 62-65: The clarify entry for the dependency "ring"
(licenses.clarify with name "ring" and expression "LicenseRef-ring") will fail
cargo-deny because "LicenseRef-ring" isn't present in the allow list; add
"LicenseRef-ring" to the existing allow list (the table that contains the
allowed license identifiers) or change the clarify expression to a license
already allowlisted (similar to the rustls-webpki pattern), ensuring the allow
list and the clarify.name "ring" / clarify.expression "LicenseRef-ring" are
consistent so cargo deny check licenses succeeds.
---
Nitpick comments:
In @.github/workflows/deny.yml:
- Around line 6-8: The workflow currently only watches Cargo.lock (the two
occurrences of paths: [Cargo.lock] under the push and pull_request triggers), so
changes to deny.toml won't run the deny checks; update both trigger path lists
to include "deny.toml" (e.g., change paths: [Cargo.lock] to paths: [Cargo.lock,
deny.toml]) so policy updates also trigger the CI job.
In `@deny.toml`:
- Around line 6-14: The deny.toml ignore list currently suppresses three
advisories ("RUSTSEC-2024-0436", "RUSTSEC-2025-0141", "RUSTSEC-2026-0002") but
lacks tracking metadata; update deny.toml to append for each advisory an inline
comment or structured metadata entry pointing to the corresponding GitHub issue
URL(s) and a planned review date (e.g., YYYY-MM-DD) so each ignored advisory has
a linked issue and a revisit date per the repository CONTRIBUTING.md process;
ensure you reference the exact advisory strings ("RUSTSEC-2024-0436",
"RUSTSEC-2025-0141", "RUSTSEC-2026-0002") when creating issues and include the
issue numbers/URLs and review dates next to them.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: b26f3e4b-c5fa-4a2a-8bb0-cd97e2b8d6f7
⛔ Files ignored due to path filters (1)
Cargo.lockis excluded by!**/*.lock
📒 Files selected for processing (2)
.github/workflows/deny.ymldeny.toml
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Run cargo-deny | ||
| uses: EmbarkStudios/cargo-deny-action@v2 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify all workflow actions are SHA-pinned (40 hex chars)
rg -n 'uses:\s*[^@]+@([0-9a-f]{40})$' .github/workflows/deny.yml
rg -n 'uses:\s*[^@]+@' .github/workflows/deny.yml
# Expected: every `uses:` line should appear in the first command's output.Repository: morph-l2/morph-reth
Length of output: 151
Pin GitHub Actions to immutable commit SHAs.
Lines 19 and 22 pin actions to mutable tags (@v4, @v2). This weakens supply-chain security; pin to full 40-character commit SHAs instead.
Suggested patch
uses: actions/checkout@v4
+ uses: actions/checkout@<full_commit_sha>
- name: Run cargo-deny
- uses: EmbarkStudios/cargo-deny-action@v2
+ uses: EmbarkStudios/cargo-deny-action@<full_commit_sha>🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/deny.yml around lines 19 - 22, The workflow uses mutable
tags "actions/checkout@v4" and "EmbarkStudios/cargo-deny-action@v2"; replace
those tag references with the corresponding full 40-character commit SHAs (e.g.,
actions/checkout@<full_sha> and EmbarkStudios/cargo-deny-action@<full_sha>) so
the runner pins to immutable commits—update the uses entries for
actions/checkout and EmbarkStudios/cargo-deny-action accordingly and verify the
SHAs match the intended release commits.
ring uses a custom license (ISC + OpenSSL + SSLeay) declared via licenses.clarify but was missing from the allow list, causing cargo-deny license checks to fail.
chengwenxi
left a comment
chengwenxi
left a comment
There was a problem hiding this comment.
LGTM. cargo-deny with well-configured policy — advisories with justified suppressions, permissive license allow-list, unknown-git = deny with explicit allowlist. Cargo.lock bumps resolve known CVEs (tar path traversal, rustls-webpki). Recommend opening a tracking issue for RUSTSEC-2026-0002 (lru unsound IterMut) to revisit when rebasing the reth fork.
2 participants
Summary
deny.tomland.github/workflows/deny.ymlto runcargo deny check allon Cargo.lock changestar0.4.44 → 0.4.45 (RUSTSEC-2026-0067, RUSTSEC-2026-0068)rustls-webpki0.103.9 → 0.103.10 (RUSTSEC-2026-0049)tracing-subscriber0.3.22 → 0.3.23lru0.12.x (RUSTSEC-2026-0002) ignored — pinned by reth fork, fix requires semver-incompatible 0.16.3Test plan
cargo deny check allpasses locally (advisories ok, bans ok, licenses ok, sources ok)Summary by CodeRabbit