Add scheduled dependency audit workflow#415
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e9e9bbfd85
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| const severity = String(advisory.severity || '').toLowerCase(); | ||
| const cvss = Number(advisory.cvss || 0); | ||
| return severity === 'high' || severity === 'critical' || cvss >= 7; |
There was a problem hiding this comment.
When cargo audit --json reports RustSec advisories, the severity is carried in advisory.cvss as a CVSS vector string such as CVSS:3.1/..., and there is no numeric advisory.severity field in the RustSec metadata. In that common case Number(advisory.cvss || 0) becomes NaN, so high/critical Cargo advisories are counted as 0 and the scheduled issue/fail step will not trigger for the Rust vulnerabilities this workflow is meant to block.
Useful? React with 👍 / 👎.
|
|
||
| - name: Run cargo deny policy | ||
| shell: bash | ||
| run: cargo deny check licenses bans |
There was a problem hiding this comment.
The new deny.toml defines a [sources] policy denying unknown registries and git sources, but this workflow only invokes licenses bans. cargo-deny only runs the named checks, with source validation handled by check sources, so a PR can add an alternate registry or git dependency without this audit enforcing the policy that was just added.
Useful? React with 👍 / 👎.
|
Deployment failed with the following error: Learn More: https://vercel.com/docs/concepts/projects/project-configuration |
1 participant
Summary
Fixes #278.
Adds a focused dependency audit workflow for npm and Cargo dependencies without changing application code.
Feasibility notes
packages/*andapps/*workspaces.Cargo.tomlwithcontracts/tariff-shieldas the member.Cargo.lockis committed, so the workflow generates a transient lockfile before runningcargo audit.docs/security.mddid not exist; this PR adds it.actions/checkout@v4,actions/setup-node@v4, and public GitHub Actions only; this workflow follows that pattern.Changes
.github/workflows/audit.yml:npm audit --audit-level=critical --jsoncargo audit, then fails only for high/critical Cargo advisoriesnpm-audit-report.jsonandcargo-audit-report.jsonartifactsdeny.tomlfor Cargo license/source/duplicate-version policy checks.docs/security.mdwith triage steps and a 24-hour critical-fix SLA.Validation
git diff --check.github/workflows/audit.ymlwith PyYAML successfully.CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H-> blocking7.0-> blocking6.9-> non-blockingnpm audit --audit-level=critical --jsonexits 0 locally; current npm audit data shows high/moderate findings but no critical findings.cargo generate-lockfilecould not be reproduced locally because crates.io index download fails on this Windows host withCRYPT_E_NO_REVOCATION_CHECK; the workflow uses GitHub-hosted Ubuntu runners and public crates.io access.