Provision Cargo for complete RustSec registry checks (#122)

.gitea/workflows/security-audit.yml

@@ -15,13 +15,13 @@ jobs:
       - name: Check out the repository
         uses: actions/checkout@v4
 
-      - name: Install the reviewed cargo-audit release
+      - name: Install Rust and the reviewed cargo-audit release
         uses: https://github.com/taiki-e/install-action@9534c84618278caac52cb373bb164ed464dbd8af # v2
         with:
-          tool: cargo-audit@0.22.2
+          tool: rust@1.92.0,cargo-audit@0.22.2
           fallback: none
 
       - name: Reject new RustSec vulnerabilities
-        # Invoke the prebuilt binary directly: the runner has no Cargo toolchain.
+        # RustSec's registry checks require Cargo even with a prebuilt audit binary.
         # The existing RSA exception is documented in docs/ssh-transport-audit.md.
         run: cargo-audit audit --ignore RUSTSEC-2023-0071

crates/storage/tests/ssh_release_audit.rs

@@ -20,7 +20,7 @@ fn release_feature_and_advisory_boundaries_stay_explicit() {
     }
     assert!(APPLE_MANIFEST.contains("default-features = false, features = [\"full\"]"));
     assert!(!APPLE_MANIFEST.contains("features = [\"ssh\"]"));
-    assert!(AUDIT_WORKFLOW.contains("tool: cargo-audit@0.22.2"));
+    assert!(AUDIT_WORKFLOW.contains("tool: rust@1.92.0,cargo-audit@0.22.2"));
     assert!(AUDIT_WORKFLOW.contains("fallback: none"));
     assert!(!AUDIT_WORKFLOW.contains("cargo install"));
     assert!(AUDIT_WORKFLOW.contains("run: cargo-audit audit --ignore RUSTSEC-2023-0071"));