perry/.github/workflows/security-audit.yml at main · PerryTS/perry · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
name: Security Audit

on:
  pull_request:
  push:
    branches: [main]
  schedule:
    - cron: "0 12 * * 1"
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: security-audit-${{ github.ref }}
  cancel-in-progress: true

jobs:
  security-audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
        with:
          shared-key: security-audit
      - name: Install cargo-audit
        run: cargo install cargo-audit --locked
      - name: Run cargo audit
        # Default cargo-audit behavior: fail on `vulnerability` advisories
        # (real CVEs), surface `unmaintained` / `notice` / `unsound` /
        # `yanked` advisories as warnings.
        #
        # `--ignore` accepts specific RUSTSEC IDs that are acknowledged
        # transitive-dep advisories with no actionable upstream fix:
        #
        # - RUSTSEC-2023-0071 (rsa) — Marvin attack timing side-channel;
        #   upstream marks "No fixed upgrade is available". The rsa
        #   crate is a transitive dep through several stacks; tracking
        #   for upstream fix.
        # - RUSTSEC-2026-0118 / -0119 (hickory-proto) — DNS query
        #   amplification + DoS surface; transitive via reqwest's
        #   tls-rustls path. Upstream hickory has a fix in main but
        #   not yet released; tracking.
        # - RUSTSEC-2026-0187 (lopdf) — stack overflow via deeply nested
        #   PDF objects. Fixed in lopdf >=0.42.0, but lopdf is transitive
        #   via printpdf (perry-ext-pdf); printpdf's latest (0.9.1) still
        #   pins lopdf ^0.39, so there is no actionable upstream bump yet.
        #   perry-ext-pdf is a PDF *creation* API (createPdf/addText/…),
        #   not a parser of untrusted PDFs, so the deeply-nested-input
        #   surface is not reached. Tracking for a printpdf release that
        #   moves to lopdf >=0.42.
        #
        # Previously the job ran `--deny warnings` which also
        # escalated every "unmaintained crate" notice into a hard
        # failure (adler, fxhash, paste, number_prefix, bincode v1,
        # etc.) — those have no in-tree replacement and were blocking
        # merges without an actionable fix. Dropped that flag; warnings
        # still surface in the log.
        run: |
          cargo audit \
            --ignore RUSTSEC-2023-0071 \
            --ignore RUSTSEC-2026-0118 \
            --ignore RUSTSEC-2026-0119 \
            --ignore RUSTSEC-2026-0187