Skip to content

Fix security dependency alerts and lock CI builds #15

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
minto-dane merged 1 commit into from
Jun 1, 2026
Merged

Fix security dependency alerts and lock CI builds #15

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 14 additions & 14 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,7 +42,7 @@ jobs:
toolchain: stable
components: clippy
- uses: Swatinem/rust-cache@42dc69e1aa15d09112580998cf2ef0119e2e91ae # v2
- run: cargo clippy --workspace --all-targets --all-features -- -D warnings
- run: cargo clippy --locked --workspace --all-targets --all-features -- -D warnings

unit-and-integration-tests:
runs-on: ubuntu-latest
Expand All @@ -53,7 +53,7 @@ jobs:
with:
toolchain: stable
- uses: Swatinem/rust-cache@42dc69e1aa15d09112580998cf2ef0119e2e91ae # v2
- run: cargo test --workspace --all-features
- run: cargo test --locked --workspace --all-features

stable-build-verification:
runs-on: ubuntu-latest
Expand All @@ -64,7 +64,7 @@ jobs:
with:
toolchain: stable
- uses: Swatinem/rust-cache@42dc69e1aa15d09112580998cf2ef0119e2e91ae # v2
- run: cargo build --release --workspace
- run: cargo build --locked --release --workspace
- run: ./scripts/verify_hardening.sh target/release/oo-bot stable
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
with:
Expand Down Expand Up @@ -99,8 +99,8 @@ jobs:
with:
toolchain: stable
- uses: Swatinem/rust-cache@42dc69e1aa15d09112580998cf2ef0119e2e91ae # v2
- run: cargo test --test runtime_protection_integration --test replay_harness --test replay_suppress_reason_regression --all-features
- run: cargo test --test fault_injection --all-features
- run: cargo test --locked --test runtime_protection_integration --test replay_harness --test replay_suppress_reason_regression --all-features
- run: cargo test --locked --test fault_injection --all-features

nextest:
runs-on: ubuntu-latest
Expand All @@ -114,7 +114,7 @@ jobs:
- uses: taiki-e/install-action@7a4939c09608b2a1986b484eca1d16fd0db8ebef # v2
with:
tool: cargo-nextest
- run: cargo nextest run --workspace --all-features --config-file nextest.toml
- run: cargo nextest run --locked --workspace --all-features --config-file nextest.toml

coverage:
runs-on: ubuntu-latest
Expand All @@ -128,7 +128,7 @@ jobs:
- uses: taiki-e/install-action@7a4939c09608b2a1986b484eca1d16fd0db8ebef # v2
with:
tool: cargo-llvm-cov
- run: cargo llvm-cov --workspace --all-features --lcov --output-path target/coverage.lcov
- run: cargo llvm-cov --locked --workspace --all-features --lcov --output-path target/coverage.lcov
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
with:
name: coverage-lcov
Expand All @@ -146,7 +146,7 @@ jobs:
- uses: taiki-e/install-action@7a4939c09608b2a1986b484eca1d16fd0db8ebef # v2
with:
tool: cargo-audit
- run: cargo audit
- run: cargo audit --locked

@chatgpt-codex-connector chatgpt-codex-connector Bot Jun 1, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Remove unsupported --locked from cargo audit

When the CI audit job runs, this invocation passes --locked to the external cargo-audit binary rather than to Cargo itself; cargo --help shows --locked as a top-level Cargo option before COMMAND, and RustSec's current cargo-audit CLI options do not define a --locked flag. As a result, the audit job will fail on argument parsing before scanning Cargo.lock, so the security check is broken instead of locked.

Useful? React with 👍 / 👎.


deny:
runs-on: ubuntu-latest
Expand All @@ -160,7 +160,7 @@ jobs:
- uses: taiki-e/install-action@7a4939c09608b2a1986b484eca1d16fd0db8ebef # v2
with:
tool: cargo-deny
- run: cargo deny check
- run: cargo deny check --locked

geiger:
runs-on: ubuntu-latest
Expand All @@ -174,7 +174,7 @@ jobs:
- uses: taiki-e/install-action@7a4939c09608b2a1986b484eca1d16fd0db8ebef # v2
with:
tool: cargo-geiger
- run: cargo geiger --all-features
- run: cargo geiger --locked --all-features

semgrep:
runs-on: ubuntu-latest
Expand All @@ -197,8 +197,8 @@ jobs:
- uses: taiki-e/install-action@7a4939c09608b2a1986b484eca1d16fd0db8ebef # v2
with:
tool: cargo-hack
- run: cargo hack check --workspace --no-dev-deps --each-feature
- run: cargo check --workspace --all-features
- run: cargo hack check --locked --workspace --no-dev-deps --each-feature
- run: cargo check --locked --workspace --all-features

canonical-config-and-artifacts:
runs-on: ubuntu-latest
Expand All @@ -209,7 +209,7 @@ jobs:
with:
toolchain: stable
- uses: Swatinem/rust-cache@42dc69e1aa15d09112580998cf2ef0119e2e91ae # v2
- run: cargo test --test defaults_canonical --all-features
- run: cargo test --locked --test defaults_canonical --all-features
- run: test -f deploy/systemd/oo-bot.service
- run: test -f deploy/apparmor/oo-bot.apparmor
- run: test -f deploy/selinux/oo_bot.te
Expand All @@ -224,6 +224,6 @@ jobs:
with:
toolchain: stable
- uses: Swatinem/rust-cache@42dc69e1aa15d09112580998cf2ef0119e2e91ae # v2
- run: RUSTDOCFLAGS='-D warnings' cargo doc --workspace --all-features --no-deps
- run: RUSTDOCFLAGS='-D warnings' cargo doc --locked --workspace --all-features --no-deps
- run: grep -q "just ci-local" README.md
- run: grep -q "trusted core" README.md
12 changes: 6 additions & 6 deletions .github/workflows/security.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,8 +27,8 @@ jobs:
with:
toolchain: ${{ matrix.toolchain }}
- uses: Swatinem/rust-cache@42dc69e1aa15d09112580998cf2ef0119e2e91ae # v2
- run: cargo +${{ matrix.toolchain }} check --workspace --all-features
- run: cargo +${{ matrix.toolchain }} test --workspace --all-features --lib
- run: cargo +${{ matrix.toolchain }} check --locked --workspace --all-features
- run: cargo +${{ matrix.toolchain }} test --locked --workspace --all-features --lib

hardened-x64-verify:
runs-on: ubuntu-latest
Expand Down Expand Up @@ -56,7 +56,7 @@ jobs:
components: rust-src
- uses: Swatinem/rust-cache@42dc69e1aa15d09112580998cf2ef0119e2e91ae # v2
- run: cargo +nightly target add x86_64-unknown-linux-gnu
- run: cargo +nightly build --release --target x86_64-unknown-linux-gnu
- run: cargo +nightly build --locked --release --target x86_64-unknown-linux-gnu
env:
OO_HARDENED_X64: "1"
RUSTFLAGS: -Zcf-protection=full -C stack-protector=strong -C link-arg=-Wl,-z,relro,-z,now
Expand All @@ -73,7 +73,7 @@ jobs:
toolchain: nightly
components: miri
- uses: Swatinem/rust-cache@42dc69e1aa15d09112580998cf2ef0119e2e91ae # v2
- run: cargo +nightly miri test --workspace
- run: cargo +nightly miri test --locked --workspace

fuzz-smoke:
runs-on: ubuntu-latest
Expand Down Expand Up @@ -117,5 +117,5 @@ jobs:
with:
toolchain: stable
- uses: Swatinem/rust-cache@42dc69e1aa15d09112580998cf2ef0119e2e91ae # v2
- run: cargo bench --bench oo_count_bench -- --warm-up-time 0.1 --measurement-time 0.2
- run: cargo bench --bench runtime_protection_bench -- --warm-up-time 0.1 --measurement-time 0.2
- run: cargo bench --locked --bench oo_count_bench -- --warm-up-time 0.1 --measurement-time 0.2
- run: cargo bench --locked --bench runtime_protection_bench -- --warm-up-time 0.1 --measurement-time 0.2
Loading
Loading