From 5f49df38a0a32ce84ef792d03fd05c4bd577c4d9 Mon Sep 17 00:00:00 2001 From: Chili Palmer Date: Sat, 12 Sep 2026 10:19:19 +0200 Subject: [PATCH] Fix security audit installation on the ARM64 runner (#122) --- .gitea/workflows/security-audit.yml | 9 +++++++-- crates/storage/tests/ssh_release_audit.rs | 6 ++++-- 2 files changed, 11 insertions(+), 4 deletions(-) diff --git a/.gitea/workflows/security-audit.yml b/.gitea/workflows/security-audit.yml index 2a66c19..34f2fb7 100644 --- a/.gitea/workflows/security-audit.yml +++ b/.gitea/workflows/security-audit.yml @@ -16,7 +16,12 @@ jobs: uses: actions/checkout@v4 - name: Install the reviewed cargo-audit release - run: cargo install cargo-audit --locked --version 0.22.2 + uses: https://github.com/taiki-e/install-action@9534c84618278caac52cb373bb164ed464dbd8af # v2 + with: + tool: cargo-audit@0.22.2 + fallback: none - name: Reject new RustSec vulnerabilities - run: cargo audit --ignore RUSTSEC-2023-0071 + # Invoke the prebuilt binary directly: the runner has no Cargo toolchain. + # The existing RSA exception is documented in docs/ssh-transport-audit.md. + run: cargo-audit audit --ignore RUSTSEC-2023-0071 diff --git a/crates/storage/tests/ssh_release_audit.rs b/crates/storage/tests/ssh_release_audit.rs index 08044c0..5c093ca 100644 --- a/crates/storage/tests/ssh_release_audit.rs +++ b/crates/storage/tests/ssh_release_audit.rs @@ -20,8 +20,10 @@ fn release_feature_and_advisory_boundaries_stay_explicit() { } assert!(APPLE_MANIFEST.contains("default-features = false, features = [\"full\"]")); assert!(!APPLE_MANIFEST.contains("features = [\"ssh\"]")); - assert!(AUDIT_WORKFLOW.contains("cargo-audit --locked --version 0.22.2")); - assert!(AUDIT_WORKFLOW.contains("cargo audit --ignore RUSTSEC-2023-0071")); + assert!(AUDIT_WORKFLOW.contains("tool: cargo-audit@0.22.2")); + assert!(AUDIT_WORKFLOW.contains("fallback: none")); + assert!(!AUDIT_WORKFLOW.contains("cargo install")); + assert!(AUDIT_WORKFLOW.contains("run: cargo-audit audit --ignore RUSTSEC-2023-0071")); assert!(AUDIT.contains("RUSTSEC-2023-0071")); }