ci: re-enable CI & OSV workflows and unify security advisory gate

.github/workflows/ci.yml.disabled → .github/workflows/ci.yml

@@ -12,6 +12,15 @@ permissions:
 env:
   CARGO_TERM_COLOR: always
 
+# Catatan exclude crate (lihat job di bawah):
+#   - vil-basic-ai-gw-demo, vil-multi-pipeline-benchmark, vil-basic-blocking-task
+#     => contoh/benchmark binaries (bukan library surface ter-publish); di-exclude
+#        agar CI cepat & tidak gagal karena dependency demo/bench yang berat.
+#   - vil_server_macros (hanya job `test`) => proc-macro crate tanpa unit test
+#     sendiri; perilakunya tervalidasi lewat test crate downstream.
+#   - `-- --skip integration` => integration tests butuh service eksternal,
+#     dijalankan terpisah di luar pipeline ini.
+
 jobs:
   check:
     name: Check
@@ -56,15 +65,21 @@ jobs:
     steps:
       - uses: actions/checkout@v5
       - run: cargo install cargo-audit --locked
+      # RUSTSEC ignore list HARUS sinkron dengan deny.toml [advisories].ignore
+      # (deny.toml = single source of truth). Update deny.toml dulu, baru di sini.
       - run: >-
           cargo audit
           --ignore RUSTSEC-2025-0009
-          --ignore RUSTSEC-2025-0073
-          --ignore RUSTSEC-2024-0421
+          --ignore RUSTSEC-2025-0010
           --ignore RUSTSEC-2023-0071
-          --ignore RUSTSEC-2025-0137
           --ignore RUSTSEC-2026-0049
-          --ignore RUSTSEC-2026-0009
+          --ignore RUSTSEC-2024-0421
+          --ignore RUSTSEC-2024-0388
+          --ignore RUSTSEC-2025-0012
+          --ignore RUSTSEC-2024-0384
+          --ignore RUSTSEC-2025-0057
+          --ignore RUSTSEC-2024-0436
+          --ignore RUSTSEC-2025-0134
 
   osv-scanner:
     name: OSV Scanner

SECURITY.md

@@ -4,7 +4,7 @@
 
 | Version | Supported          |
 |---------|--------------------|
-| 0.1.x   | :white_check_mark: |
+| 0.4.x   | :white_check_mark: |
 
 ## Reporting a Vulnerability
 

deny.toml

@@ -1,8 +1,10 @@
 # cargo-deny configuration
 # https://embarkstudios.github.io/cargo-deny/
 #
-# Remaining advisories are all transitive deps locked by upstream.
-# Tracked in docs-dev/dependency-audit-2026-03-29.md
+# Remaining advisories are all transitive deps locked by upstream and cannot be
+# bumped until upstream ships fixes; each entry below is annotated inline with the
+# affected crate + reason. This [advisories].ignore list is the single source of
+# truth -- keep .github/workflows/ci.yml (cargo audit --ignore ...) in sync.
 
 [advisories]
 ignore = [