Skip to content

Commit af24efc

Browse files
lfranckeclaude
andcommitted
ci(template): build cargo-audit against stable rust toolchain
The daily security audit builds cargo-audit from source using the toolchain pinned in rust-toolchain.toml. A transitive build dependency (kstring 2.0.4) now requires Rust 1.96.0, which is newer than the pinned channel, so the build fails and the audit never runs. Override RUSTUP_TOOLCHAIN=stable for the audit step so cargo-audit is built with current stable. The toolchain used to build the tool does not affect the audit result, so this is safe. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
1 parent 23454ae commit af24efc

1 file changed

Lines changed: 5 additions & 0 deletions

File tree

template/.github/workflows/general_daily_security.yml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,5 +20,10 @@ jobs:
2020
with:
2121
persist-credentials: false
2222
- uses: rustsec/audit-check@69366f33c96575abad1ee0dba8212993eecbe998 # v2.0.0
23+
# Build against stable because cargo-audit sometimes depends on things
24+
# that require a newer Rust version than our pinned toolchain. This does
25+
# not influence the result, so it should be safe.
26+
env:
27+
RUSTUP_TOOLCHAIN: stable
2328
with:
2429
token: ${{ secrets.GITHUB_TOKEN }}

0 commit comments

Comments
 (0)