Repository navigation
fix(ci): clear Daily Maintenance cargo-audit failures - #53
Merged
Merged
Conversation
Bump vulnerable crates so cargo audit reports 0 vulnerabilities: - rustls 0.23.40→0.23.45 - quinn-proto 0.11.14→0.11.19 - wasmtime/wasmtime-wasi 16.0→36.0.17 (port wasm_loader to preview1 API) - anyhow 1.0.102→1.0.104, event-listener 5.4.1→5.4.2 A follow-up (or same PR via workflow-scoped token) is needed for the Daily Maintenance step logic that greps the JSON key name and fails on cargo audit's non-zero exit even when reporting to the summary.
The Daily Maintenance workflow currently greps for the JSON key "vulnerabilities" (always present) and can fail on cargo audit's exit code while writing the summary. This adds scripts/ci-security-audit.sh that counts via jq and fails only when vulnerability count > 0 after ignores, plus an intended workflow snippet under docs/ci/ for a follow-up that updates .github/workflows/daily-maintenance.yml (requires a token with the `workflow` scope).
3 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes the red Daily Maintenance job (
系统健康检查→安全漏洞扫描), which has been failing on schedule for about a week (e.g. https://github.com/Mouseww/hakimi-agent/actions/runs/37751078074 witherror: 29 vulnerabilities found!). RegularCIon main was already green.Dependency / lockfile fixes (makes
cargo auditexit 0)rustlsquinn-protowasmtime/wasmtime-wasicap-primitivesanyhowevent-listenercrates/hakimi-pluginWASM loader ported to wasmtime 36preview1(WasiP1Ctx/add_to_linker_sync/ newpreopened_dirAPI). Featurewasmstill optional.Ignored advisories: none (no
audit.tomlneeded). Remainingcargo auditoutput is warnings-only (unmaintained transitive crates +lruvia ratatui +glibvia GTK/Tauri).Workflow logic fix (blocked from this token)
The step still greps for the JSON key
"vulnerabilities"(always present) and can fail oncargo audit's non-zero exit while writing$GITHUB_STEP_SUMMARY.This PR adds:
scripts/ci-security-audit.sh— count viajqon.vulnerabilities.count/.list|length; always report; fail only if count > 0docs/ci/daily-maintenance.yml.intended+ snippet — exact replacement for.github/workflows/daily-maintenance.ymlPushing under
.github/workflows/was refused: currentghOAuth token scopes arerepo,gist,read:org(missingworkflow). After merge (or on this branch), apply with:gh auth refresh -s workflow cp docs/ci/daily-maintenance.yml.intended .github/workflows/daily-maintenance.yml git add .github/workflows/daily-maintenance.yml git commit -m "fix(ci): use jq-based cargo-audit gate in Daily Maintenance" git pushUntil that lands, clearing the 29 vulns alone should make the existing step pass (second
cargo auditexits 0 when count is 0).Verification
cargo audit→ 0 vulnerabilities, exit 0cargo check --all→ okcargo test -p hakimi-plugin --features wasm→ 38 passedTest plan
安全漏洞扫描is greenworkflow-scoped token is available