[LOW] Makefile audit/deny targets fail opaquely when cargo-audit/cargo-deny are not installed

[Alqku]

Overview

make audit and make deny invoke cargo audit and cargo deny check directly (Makefile lines for audit and deny). On a fresh contributor environment or CI runner without those binaries pre-installed, both targets fail with make: cargo: Command not found (or worse, "command missing" mid-pipeline) and block the CI explanation ("load a deny.toml") rather than guiding the user to install the tool first. README's "Security Scans" section promises make audit and make deny as entry points but doesn't list the dependency.

Evidence

# Makefile
audit:
	@echo "🔒 Running security audit..."
	cargo audit
	@echo "✅ Security audit passed"

deny:
	@echo "📋 Checking license compliance..."
	cargo deny check
	@echo "✅ License check passed"

Neither target guards for the absence of the binary. CONTRIBUTING.md does not mention cargo-audit / cargo-deny as install steps. CI does not pre-install them either (assumed from a typical GH Actions workflow — not strictly visible from the repo).

Impact

• New contributors hit a wall at make audit / make deny with no recovery instruction.
• CI that lints both ways is silently disabled when one tool is missing.
• Hard to triage: a real vulnerability finding and a missing binary look the same in the logs.

Recommended Approach

Pre-check the binary and produce a crisp error message, e.g.:

audit:
	@if ! command -v cargo-audit >/dev/null 2>&1; then \
		echo "❌ cargo-audit not installed. Run 'cargo install cargo-audit --locked' then retry." >&2; \
		exit 1; \
	fi
	@echo "🔒 Running security audit..."
	cargo audit
	@echo "✅ Security audit passed"

deny:
	@if ! command -v cargo-deny >/dev/null 2>&1; then \
		echo "❌ cargo-deny not installed. Run 'cargo install cargo-deny --locked' then retry." >&2; \
		exit 1; \
	fi
	@echo "📋 Checking license compliance..."
	cargo deny check
	@echo "✅ License check passed"

Alternatively, factor into a single make setup step that the README/CONTRIBUTING.md recommends users run first.

Acceptance Criteria

• make audit and make deny emit a clear "tool not installed — run cargo install …" message and a non-zero exit code when the binary is missing
• Normal flow (tool installed) is unchanged
• CONTRIBUTING.md and README "Security Scans" section explicitly mention the install commands before recommending make audit / make deny
• CI workflow (.github/workflows/*.yml) installs cargo-audit and cargo-deny either via dedicated steps or via a matrix that fails-fast if missing

Affected Files

• Makefile
• README.md (Security Scans section)
• CONTRIBUTING.md (if it exists; otherwise create it — see related docs hygiene)
• .github/workflows/ci.yml or equivalent

[Tobi-8]

I can audit this

[gloskull]

Hello, I have 4 years of experience delivering solutions for projects like this, covering backend, frontend, and smart contract development. After carefully reviewing your requirements, I have a clear understanding of the task and am confident in my ability to deliver a clean, efficient, and thoroughly tested solution on time. I prioritize code quality, maintainability, and industry best practices throughout the development process.
My PR will be submitted in under 2days.

[dangelo352]

Submitted PR #65: #65

It adds missing-tool preflight checks for make audit / make deny, documents cargo install cargo-audit --locked and cargo install cargo-deny --locked, adds a CONTRIBUTING checklist, and wires CI jobs to install and run both tools.