Subtask of #169 (worth doing now, ranked 3).
rust-deny fires only on push and pull_request. So a fresh RustSec advisory
against a dependency does not announce itself — it waits, and then fails
whichever stranger's PR happens to arrive next, in a job that has nothing to do
with their change.
Suggested direction
A schedule: cron running an advisories-only cargo deny check advisories.
Keep it separate from the gating rust-deny job so a new advisory does not
retroactively turn main red; the point is to shoot the messenger somewhere
other than a contributor's PR.
Why not just rely on Dependabot alerts
They cover most of it. RustSec's unmaintained and unsound classes are its
own, and deny.toml already opts into them — a scheduled run is what surfaces
them on our schedule rather than someone else's.
Note cargo-audit itself was assessed and skipped: redundant with cargo deny.
Subtask of #169 (worth doing now, ranked 3).
rust-denyfires only on push and pull_request. So a fresh RustSec advisoryagainst a dependency does not announce itself — it waits, and then fails
whichever stranger's PR happens to arrive next, in a job that has nothing to do
with their change.
Suggested direction
A
schedule:cron running an advisories-onlycargo deny check advisories.Keep it separate from the gating
rust-denyjob so a new advisory does notretroactively turn
mainred; the point is to shoot the messenger somewhereother than a contributor's PR.
Why not just rely on Dependabot alerts
They cover most of it. RustSec's
unmaintainedandunsoundclasses are itsown, and
deny.tomlalready opts into them — a scheduled run is what surfacesthem on our schedule rather than someone else's.
Note
cargo-audititself was assessed and skipped: redundant withcargo deny.