From 9e03f302ca7f015af0e91cf3bc15afcbc8bbb846 Mon Sep 17 00:00:00 2001
From: mibrohimsulaeman-a11y
 <236154532+mibrohimsulaeman-a11y@users.noreply.github.com>
Date: Sat, 6 Jun 2026 16:40:26 +0700
Subject: [PATCH] ci: re-enable CI & OSV workflows and unify security advisory
 gate

- Rename ci.yml.disabled & osv-scan.yml.disabled back to active workflows

- Sync cargo audit --ignore list in ci.yml with deny.toml [advisories].ignore (deny.toml = single source of truth)

- Replace dead docs-dev/ reference in deny.toml with inline rationale (path is gitignored)

- Bump SECURITY.md Supported Versions 0.1.x -> 0.4.x

- Document intentional --workspace --exclude crates in ci.yml comments
---
 .github/workflows/{ci.yml.disabled => ci.yml} | 23 +++++++++++++++----
 .../{osv-scan.yml.disabled => osv-scan.yml}   |  0
 SECURITY.md                                   |  2 +-
 deny.toml                                     |  6 +++--
 4 files changed, 24 insertions(+), 7 deletions(-)
 rename .github/workflows/{ci.yml.disabled => ci.yml} (71%)
 rename .github/workflows/{osv-scan.yml.disabled => osv-scan.yml} (100%)

diff --git a/.github/workflows/ci.yml.disabled b/.github/workflows/ci.yml
similarity index 71%
rename from .github/workflows/ci.yml.disabled
rename to .github/workflows/ci.yml
index 4e4c1967..ce5828ce 100644
--- a/.github/workflows/ci.yml.disabled
+++ b/.github/workflows/ci.yml
@@ -12,6 +12,15 @@ permissions:
 env:
   CARGO_TERM_COLOR: always
 
+# Catatan exclude crate (lihat job di bawah):
+#   - vil-basic-ai-gw-demo, vil-multi-pipeline-benchmark, vil-basic-blocking-task
+#     => contoh/benchmark binaries (bukan library surface ter-publish); di-exclude
+#        agar CI cepat & tidak gagal karena dependency demo/bench yang berat.
+#   - vil_server_macros (hanya job `test`) => proc-macro crate tanpa unit test
+#     sendiri; perilakunya tervalidasi lewat test crate downstream.
+#   - `-- --skip integration` => integration tests butuh service eksternal,
+#     dijalankan terpisah di luar pipeline ini.
+
 jobs:
   check:
     name: Check
@@ -56,15 +65,21 @@ jobs:
     steps:
       - uses: actions/checkout@v5
       - run: cargo install cargo-audit --locked
+      # RUSTSEC ignore list HARUS sinkron dengan deny.toml [advisories].ignore
+      # (deny.toml = single source of truth). Update deny.toml dulu, baru di sini.
       - run: >-
           cargo audit
           --ignore RUSTSEC-2025-0009
-          --ignore RUSTSEC-2025-0073
-          --ignore RUSTSEC-2024-0421
+          --ignore RUSTSEC-2025-0010
           --ignore RUSTSEC-2023-0071
-          --ignore RUSTSEC-2025-0137
           --ignore RUSTSEC-2026-0049
-          --ignore RUSTSEC-2026-0009
+          --ignore RUSTSEC-2024-0421
+          --ignore RUSTSEC-2024-0388
+          --ignore RUSTSEC-2025-0012
+          --ignore RUSTSEC-2024-0384
+          --ignore RUSTSEC-2025-0057
+          --ignore RUSTSEC-2024-0436
+          --ignore RUSTSEC-2025-0134
 
   osv-scanner:
     name: OSV Scanner
diff --git a/.github/workflows/osv-scan.yml.disabled b/.github/workflows/osv-scan.yml
similarity index 100%
rename from .github/workflows/osv-scan.yml.disabled
rename to .github/workflows/osv-scan.yml
diff --git a/SECURITY.md b/SECURITY.md
index 5f806f1a..bf5d9347 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -4,7 +4,7 @@
 
 | Version | Supported          |
 |---------|--------------------|
-| 0.1.x   | :white_check_mark: |
+| 0.4.x   | :white_check_mark: |
 
 ## Reporting a Vulnerability
 
diff --git a/deny.toml b/deny.toml
index afed3a84..6190e70a 100644
--- a/deny.toml
+++ b/deny.toml
@@ -1,8 +1,10 @@
 # cargo-deny configuration
 # https://embarkstudios.github.io/cargo-deny/
 #
-# Remaining advisories are all transitive deps locked by upstream.
-# Tracked in docs-dev/dependency-audit-2026-03-29.md
+# Remaining advisories are all transitive deps locked by upstream and cannot be
+# bumped until upstream ships fixes; each entry below is annotated inline with the
+# affected crate + reason. This [advisories].ignore list is the single source of
+# truth -- keep .github/workflows/ci.yml (cargo audit --ignore ...) in sync.
 
 [advisories]
 ignore = [