fix(ci): the licence gate never ran, and aarch64 needs __ARM_ARCH

cargo deny has been failing to start on every run. In 0.18 `--config` belongs to
the `check` subcommand, not the global level, so the invocation died with
"unexpected argument '--config' found" and exit 2. Because the step runs under
`set +e` and only enforces when `strict`, non-strict runs downgraded that to a
warning and dependency-audit reported success - so the licence/bans/sources gate
has executed nothing at all, and neither has the informational advisory scan.
Both invocations fixed.

Also stop a broken gate from ever looking like a clean one: exit >1 is clap
saying the tool never ran, which is not a policy finding and is now a hard
failure in every mode. Only a real violation (exit 1) remains subject to strict.
The informational leg stays non-blocking but now says plainly when the scan did
not run, instead of printing nothing and implying all-clear.

aarch64: my previous sccache theory was wrong. The failure reproduced with the
compiler invoked directly, so sccache was never the cause. ring 0.17's
asm_base.h hard-errors because the manylinux cross-gcc does not predefine
__ARM_ARCH when assembling chacha-armv8-linux64.S; define it for that target.
ring is already at its newest compatible version, so there is nothing to bump.

Author: Guillaume Lessard

.github/workflows/dependency-audit.yml

@@ -111,9 +111,23 @@ jobs:
           STRICT: ${{ inputs.strict == true }}
         run: |
           set +e
-          cargo deny --all-features --config .github/deny.toml check licenses bans sources
+          # `--config` belongs to the `check` subcommand in cargo-deny 0.18;
+          # `--all-features` stays global. It used to sit before `check`, which
+          # 0.18 rejects with "unexpected argument '--config' found" and exit 2.
+          cargo deny --all-features check --config .github/deny.toml licenses bans sources
           rc=$?
           set -e
+
+          # Exit 2 is clap: cargo deny never ran. That is NOT a policy warning,
+          # and downgrading it to one is how a broken invocation went unnoticed -
+          # non-strict runs reported success while the licence gate executed
+          # nothing at all. A gate that cannot run is always a hard failure,
+          # in every mode; only an actual policy violation (exit 1) is subject
+          # to `strict`.
+          if [ "$rc" -gt 1 ]; then
+            echo "::error title=cargo deny::cargo deny failed to execute (exit $rc) - the licence/bans/sources gate did NOT run. This is never downgraded to a warning."
+            exit "$rc"
+          fi
           if [ "$rc" -ne 0 ]; then
             if [ "$STRICT" = "true" ]; then
               echo "::error title=cargo deny::Licence/source policy violation. Release blocked. Update .github/deny.toml AND NOTICE.md only after a deliberate legal review."
@@ -128,10 +142,17 @@ jobs:
       - name: cargo deny (informational advisories, never blocking)
         run: |
           set +e
-          cargo deny --all-features --config .github/deny.toml check advisories
+          # Same 0.18 flag-position fix as the gating step above.
+          cargo deny --all-features check --config .github/deny.toml advisories
           rc=$?
           set -e
-          if [ "$rc" -ne 0 ]; then
+          # This leg never blocks, by design. But distinguish "advisories found"
+          # from "the scan did not run": the latter reported a clean warning for
+          # as long as the invocation was malformed, which is indistinguishable
+          # from good news in the log.
+          if [ "$rc" -gt 1 ]; then
+            echo "::warning title=cargo deny advisories::cargo deny failed to execute (exit $rc) - the informational advisory scan did NOT run. Not blocking, but the absence of findings below means nothing."
+          elif [ "$rc" -ne 0 ]; then
             echo "::warning title=cargo deny advisories::Informational RustSec advisories present (unmaintained/unsound/notice). Advisory only — never blocks. Triage at the quarterly review."
           fi
 

.github/workflows/release-build.yml

@@ -88,12 +88,15 @@ jobs:
             --out dist
             --no-default-features
             --features abi3${{ matrix.features && format(',{0}', matrix.features) || '' }}
-          # sccache is disabled for the Linux aarch64 cross-build. Wrapping the
-          # cross-assembler breaks ring's .S files: `aarch64-unknown-linux-gnu-gcc`
-          # is invoked on chacha-armv8-linux64.S without __ARM_ARCH defined, and
-          # ring's asm_base.h then fails the build outright with
-          # `#error "ARM assembler must define __ARM_ARCH"`. Native aarch64
-          # (macos-14) is unaffected and keeps the cache.
+          # Linux aarch64 cross-build: ring 0.17's asm_base.h hard-errors with
+          # `#error "ARM assembler must define __ARM_ARCH"` because the
+          # cross-gcc in the manylinux container does not predefine it when
+          # assembling chacha-armv8-linux64.S. Define it explicitly for that one
+          # target. (sccache was suspected first and ruled out - the failure
+          # reproduced with the compiler invoked directly.) ring is already at
+          # its newest version compatible with this tree, so there is nothing to
+          # bump instead.
+          docker-options: ${{ (matrix.os == 'ubuntu-latest' && matrix.target == 'aarch64') && '-e CFLAGS_aarch64_unknown_linux_gnu=-D__ARM_ARCH=8 -e CC_aarch64_unknown_linux_gnu=aarch64-unknown-linux-gnu-gcc' || '' }}
           sccache: ${{ !(matrix.os == 'ubuntu-latest' && matrix.target == 'aarch64') }}
 
       - name: Show built wheels