ci: run the advisory check on a schedule - #213
Merged
Merged
Conversation
rust-deny fires only on push and pull_request, so a RustSec advisory published today announces itself by failing whichever stranger's PR arrives next, in a job unrelated to their change. A separate workflow rather than a `schedule:` on ci.yml: that trigger is workflow-level, so it would run every ci.yml job weekly and muddy the required contexts. Shaped after codeql.yml — weekly cron, read-only permissions, persist-credentials: false — plus workflow_dispatch to hand-fire it. Advisories only, and deliberately not folded into the gating rust-deny job, so a fresh advisory does not retroactively redden main. Surfacing is GitHub's failed-run email to the repo owner and nothing else: no page, no auto-filed issue. Keep `advisories` off the required status checks, or it reintroduces exactly the blocking this removes. Note GitHub disables crons after 60 days of repo inactivity, so silence alone is not proof of a clean tree. cargo-audit was assessed and skipped as redundant with cargo-deny; that decision is #169's and is not reopened here. Verified: `cargo deny check advisories` is clean on this tree, and the same invocation against a local advisory-db carrying a fabricated serde advisory exits 1 ("advisories FAILED"), so an advisory does fail the job. actionlint 1.7.12 is clean over .github/workflows/. Closes #197
plusky
added
the
ai-assisted
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #197. One new workflow file.
rust-denyfires only on push/PR, so a fresh RustSec advisory waits and thenfails whichever stranger's PR arrives next, in a job unrelated to their
change. Weekly advisories-only run, separate from the gating job so a new
advisory never retroactively reddens a contributor's PR.
schedule+workflow_dispatchonly — cannot become a PR check, and is not inbranch protection.
Two limits on its value, both documented in-file
if Actions notifications are enabled, and for a cron the recipient is whoever
last edited the cron line.
(this repo is public, so it applies). Silence from this job is not evidence
of a clean tree. No keepalive added — that needs
contents: writeand dummycommits, against this repo's permissions posture.
Verified
cargo deny check advisoriesclean today. Forced failure via a fabricatedRUSTSEC entry in a local db copy:
advisories FAILED, exit 1 — reproducedindependently by review. The action invocation was checked at the pinned SHA:
the entrypoint composes
<arguments> <command> <command-arguments>, so thecheck name belongs in
command-arguments.concurrencydeliberately diverges from the house pattern (group: ${{ github.workflow }},cancel-in-progress: false): the ref key is a no-op fora cron, and cancelling would let the weekly run kill a hand-fired one.
codeql.ymlhas no concurrency block at all — the brief was wrong about that.
cargo-auditstays rejected as redundant with cargo-deny (#169).Review: MERGE-SAFE.