Skip to content

Commit 1855734

Browse files
pacphidependabot[bot]ruvnet
authored
ci: rollup of GitHub Actions bumps + cargo-audit SARIF upload (#288)
* ci(deps): bump actions/attest-build-provenance from 2.4.0 to 4.1.0 Bumps [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance) from 2.4.0 to 4.1.0. - [Release notes](https://github.com/actions/attest-build-provenance/releases) - [Commits](actions/attest-build-provenance@v2.4.0...v4.1.0) --- updated-dependencies: - dependency-name: actions/attest-build-provenance dependency-version: 4.1.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> * ci(deps): bump actions/cache from 4.3.0 to 5.0.5 Bumps [actions/cache](https://github.com/actions/cache) from 4.3.0 to 5.0.5. - [Release notes](https://github.com/actions/cache/releases) - [Commits](actions/cache@v4.3.0...v5.0.5) --- updated-dependencies: - dependency-name: actions/cache dependency-version: 5.0.5 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> * ci(deps): bump cargo-bins/cargo-binstall from 1.18.1 to 1.19.0 Bumps [cargo-bins/cargo-binstall](https://github.com/cargo-bins/cargo-binstall) from 1.18.1 to 1.19.0. - [Release notes](https://github.com/cargo-bins/cargo-binstall/releases) - [Changelog](https://github.com/cargo-bins/cargo-binstall/blob/main/release-plz.toml) - [Commits](cargo-bins/cargo-binstall@v1.18.1...v1.19.0) --- updated-dependencies: - dependency-name: cargo-bins/cargo-binstall dependency-version: 1.19.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * ci(deps): bump oras-project/setup-oras from 1.2.4 to 2.0.0 Bumps [oras-project/setup-oras](https://github.com/oras-project/setup-oras) from 1.2.4 to 2.0.0. - [Release notes](https://github.com/oras-project/setup-oras/releases) - [Commits](oras-project/setup-oras@22ce207...38de303) --- updated-dependencies: - dependency-name: oras-project/setup-oras dependency-version: 2.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> * ci(deps): bump actions/upload-artifact from 4.6.2 to 7.0.1 Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4.6.2 to 7.0.1. - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@v4.6.2...v7.0.1) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> * ci(main): upload v4 cargo-audit findings to GitHub Security as SARIF Pipes `cargo audit --json` (which honors `v4/.cargo/audit.toml` ignores) through a jq-based SARIF v2.1.0 converter and uploads via `github/codeql-action/upload-sarif@v4`. Because `ci-v4.yml` only triggers on the `v4` branch, advisories are now attributed to `refs/heads/v4` instead of being invisible in the Security tab. Avoids `rustsec/audit-check@v2` because it does not respect cargo-audit ignores. The audit job still re-fails when cargo-audit reports vulnerabilities, preserving the prior CI verdict. Closes the post-reorg telemetry gap where v4 advisories had no path into GitHub code-scanning UI. Co-Authored-By: claude-flow <ruv@ruv.net> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: claude-flow <ruv@ruv.net>
1 parent 75efe29 commit 1855734

21 files changed

Lines changed: 173 additions & 61 deletions

‎.github/workflows/_ci-rust.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -143,7 +143,7 @@ jobs:
143143
cargo build --release --workspace $target_arg $features_arg
144144
- name: Upload release binary
145145
if: ${{ inputs.target == 'x86_64-unknown-linux-musl' }}
146-
uses: actions/upload-artifact@v7
146+
uses: actions/upload-artifact@v7.0.1
147147
with:
148148
name: sindri-${{ inputs.workspace_dir }}-binaries-${{ github.sha }}
149149
path: ${{ inputs.workspace_dir }}/target/${{ inputs.target }}/release/sindri

‎.github/workflows/_release-cargo-dist.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,7 @@ jobs:
5454
run: cargo install cross --git https://github.com/cross-rs/cross
5555

5656
- name: Cache cargo registry + target
57-
uses: actions/cache@v5
57+
uses: actions/cache@v5.0.5
5858
with:
5959
path: |
6060
~/.cargo/bin/
@@ -93,7 +93,7 @@ jobs:
9393
}
9494
9595
- name: Upload artifact
96-
uses: actions/upload-artifact@v7
96+
uses: actions/upload-artifact@v7.0.1
9797
with:
9898
name: binary-${{ matrix.platform }}
9999
path: |

‎.github/workflows/check-links.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ jobs:
2828
uses: actions/checkout@v6
2929

3030
- name: Restore lychee cache
31-
uses: actions/cache@v5
31+
uses: actions/cache@v5.0.5
3232
with:
3333
path: .lycheecache
3434
key: cache-lychee-${{ github.sha }}
@@ -55,7 +55,7 @@ jobs:
5555

5656
- name: Upload internal link report
5757
if: always()
58-
uses: actions/upload-artifact@v7
58+
uses: actions/upload-artifact@v7.0.1
5959
with:
6060
name: lychee-internal-report
6161
path: lychee-internal.md
@@ -71,7 +71,7 @@ jobs:
7171
uses: actions/checkout@v6
7272

7373
- name: Restore lychee cache
74-
uses: actions/cache@v5
74+
uses: actions/cache@v5.0.5
7575
with:
7676
path: .lycheecache
7777
key: cache-lychee-external-${{ github.sha }}
@@ -105,7 +105,7 @@ jobs:
105105

106106
- name: Upload external link report
107107
if: always()
108-
uses: actions/upload-artifact@v7
108+
uses: actions/upload-artifact@v7.0.1
109109
with:
110110
name: lychee-external-report
111111
path: lychee-external.md

‎.github/workflows/ci-v3.yml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,7 @@ jobs:
6767
with:
6868
workspaces: v3 -> target
6969
- name: Install cargo-binstall
70-
uses: cargo-bins/cargo-binstall@v1.18.1
70+
uses: cargo-bins/cargo-binstall@v1.19.0
7171
- name: Install cargo-machete
7272
run: cargo binstall cargo-machete --no-confirm
7373
- name: Scan for unused dependencies
@@ -110,7 +110,7 @@ jobs:
110110
workspaces: v3 -> target
111111

112112
- name: Install cargo-binstall
113-
uses: cargo-bins/cargo-binstall@v1.18.1
113+
uses: cargo-bins/cargo-binstall@v1.19.0
114114

115115
- name: Install cargo-llvm-cov
116116
run: cargo binstall cargo-llvm-cov --no-confirm --force
@@ -184,7 +184,7 @@ jobs:
184184
fail_ci_if_error: false
185185

186186
- name: Upload coverage report
187-
uses: actions/upload-artifact@v7
187+
uses: actions/upload-artifact@v7.0.1
188188
with:
189189
name: coverage-lcov-${{ github.sha }}
190190
path: |
@@ -285,7 +285,7 @@ jobs:
285285
286286
- name: Attest build provenance
287287
if: steps.build.outputs.digest != ''
288-
uses: actions/attest-build-provenance@v4
288+
uses: actions/attest-build-provenance@v4.1.0
289289
with:
290290
subject-name: ghcr.io/${{ github.repository }}
291291
subject-digest: ${{ steps.build.outputs.digest }}
@@ -405,7 +405,7 @@ jobs:
405405
uses: dtolnay/rust-toolchain@stable
406406

407407
- name: Install cargo-binstall
408-
uses: cargo-bins/cargo-binstall@v1.18.1
408+
uses: cargo-bins/cargo-binstall@v1.19.0
409409

410410
- name: Install cargo-audit
411411
run: cargo binstall cargo-audit --no-confirm
@@ -726,7 +726,7 @@ jobs:
726726
727727
- name: Upload test results
728728
if: always()
729-
uses: actions/upload-artifact@v7
729+
uses: actions/upload-artifact@v7.0.1
730730
with:
731731
name: provider-test-results-${{ matrix.provider }}-${{ github.sha }}
732732
path: v3/provider-test-results.txt

‎.github/workflows/ci-v4.yml‎

Lines changed: 115 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ jobs:
4242
with:
4343
targets: ${{ matrix.target }}
4444
- name: Cache cargo
45-
uses: actions/cache@v5
45+
uses: actions/cache@v5.0.5
4646
with:
4747
path: |
4848
~/.cargo/registry
@@ -91,10 +91,122 @@ jobs:
9191
audit:
9292
name: Security audit
9393
runs-on: ubuntu-latest
94+
permissions:
95+
contents: read
96+
security-events: write
9497
steps:
9598
- uses: actions/checkout@v6
9699
- name: Install cargo-audit
97100
run: cargo install cargo-audit --locked
98-
- name: Run audit
101+
102+
# `cargo audit --json` honors v4/.cargo/audit.toml ignores, so SARIF
103+
# output below reflects the same advisory set the human-readable
104+
# `cargo audit` step would surface. The SARIF upload routes findings
105+
# to the GitHub Security tab keyed to refs/heads/v4 (since this
106+
# workflow only triggers on the v4 branch), keeping advisories
107+
# attributed to the right branch after the April 2026 reorg.
108+
- name: Run audit (JSON)
109+
id: audit
99110
working-directory: v4
100-
run: cargo audit
111+
continue-on-error: true
112+
run: |
113+
set -o pipefail
114+
cargo audit --json > "$RUNNER_TEMP/audit.json"
115+
116+
- name: Convert audit JSON to SARIF
117+
if: always() && hashFiles(format('{0}/audit.json', runner.temp)) != ''
118+
run: |
119+
jq '
120+
def sev_to_level:
121+
ascii_downcase
122+
| if . == "critical" then "error"
123+
elif . == "high" then "error"
124+
elif . == "medium" then "warning"
125+
elif . == "low" then "note"
126+
else "warning" end;
127+
{
128+
"$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
129+
"version": "2.1.0",
130+
"runs": [{
131+
"tool": {
132+
"driver": {
133+
"name": "cargo-audit",
134+
"informationUri": "https://github.com/rustsec/rustsec/tree/main/cargo-audit",
135+
"rules": (
136+
[.vulnerabilities.list[]?
137+
| .advisory as $a
138+
| {
139+
"id": $a.id,
140+
"name": $a.id,
141+
"shortDescription": { "text": $a.title },
142+
"fullDescription": { "text": ($a.description // $a.title) },
143+
"helpUri": ($a.url // "https://rustsec.org/advisories/\($a.id).html"),
144+
"defaultConfiguration": {
145+
"level": (($a.severity // "warning") | sev_to_level)
146+
},
147+
"properties": {
148+
"tags": ["security", "rust", "rustsec"],
149+
"security-severity": (
150+
if ($a.severity // "" | ascii_downcase) == "critical" then "9.5"
151+
elif ($a.severity // "" | ascii_downcase) == "high" then "7.5"
152+
elif ($a.severity // "" | ascii_downcase) == "medium" then "5.0"
153+
elif ($a.severity // "" | ascii_downcase) == "low" then "3.0"
154+
else "5.0" end
155+
)
156+
}
157+
}
158+
] | unique_by(.id)
159+
)
160+
}
161+
},
162+
"results": (
163+
[.vulnerabilities.list[]?
164+
| {
165+
"ruleId": .advisory.id,
166+
"level": ((.advisory.severity // "warning") | sev_to_level),
167+
"message": {
168+
"text": "\(.package.name) \(.package.version): \(.advisory.title) (\(.advisory.id))"
169+
},
170+
"locations": [{
171+
"physicalLocation": {
172+
"artifactLocation": { "uri": "v4/Cargo.lock" },
173+
"region": { "startLine": 1 }
174+
}
175+
}],
176+
"partialFingerprints": {
177+
"advisory/package/version":
178+
"\(.advisory.id)/\(.package.name)/\(.package.version)"
179+
}
180+
}
181+
]
182+
)
183+
}]
184+
}
185+
' "$RUNNER_TEMP/audit.json" > "$RUNNER_TEMP/audit.sarif"
186+
echo "SARIF results:"
187+
jq '.runs[0].results | length' "$RUNNER_TEMP/audit.sarif"
188+
189+
- name: Upload SARIF to GitHub Security
190+
if: always() && hashFiles(format('{0}/audit.sarif', runner.temp)) != ''
191+
uses: github/codeql-action/upload-sarif@v4
192+
with:
193+
sarif_file: ${{ runner.temp }}/audit.sarif
194+
category: cargo-audit-v4
195+
196+
- name: Audit summary
197+
if: always()
198+
run: |
199+
if [ -f "$RUNNER_TEMP/audit.json" ]; then
200+
COUNT=$(jq '.vulnerabilities.count // 0' "$RUNNER_TEMP/audit.json")
201+
echo "## cargo-audit (v4)" >> "$GITHUB_STEP_SUMMARY"
202+
echo "- **Vulnerabilities reported (post-ignore):** $COUNT" >> "$GITHUB_STEP_SUMMARY"
203+
echo "- **Ignores honored from:** \`v4/.cargo/audit.toml\`" >> "$GITHUB_STEP_SUMMARY"
204+
fi
205+
206+
# Re-fail the job if cargo audit found anything, so CI status reflects
207+
# the audit result even though the JSON step uses continue-on-error.
208+
- name: Enforce audit verdict
209+
if: steps.audit.outcome == 'failure'
210+
run: |
211+
echo "::error::cargo audit reported vulnerabilities (see SARIF / Security tab)"
212+
exit 1

‎.github/workflows/integration-test-providers.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,7 @@ jobs:
5858
run: cd v3 && cargo build --release
5959

6060
- name: Upload binary
61-
uses: actions/upload-artifact@v7
61+
uses: actions/upload-artifact@v7.0.1
6262
with:
6363
name: sindri-integration-binary-${{ github.sha }}
6464
path: v3/target/release/sindri
@@ -230,7 +230,7 @@ jobs:
230230
echo "- Destroy: PASS" >> $GITHUB_STEP_SUMMARY
231231
232232
- name: Upload test logs
233-
uses: actions/upload-artifact@v7
233+
uses: actions/upload-artifact@v7.0.1
234234
if: always()
235235
with:
236236
name: runpod-integration-logs-${{ github.sha }}
@@ -293,7 +293,7 @@ jobs:
293293
echo "- Destroy: PASS" >> $GITHUB_STEP_SUMMARY
294294
295295
- name: Upload test logs
296-
uses: actions/upload-artifact@v7
296+
uses: actions/upload-artifact@v7.0.1
297297
if: always()
298298
with:
299299
name: northflank-integration-logs-${{ github.sha }}

‎.github/workflows/registry-core-publish.yml‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -151,7 +151,7 @@ jobs:
151151
ref: v4
152152
- uses: dtolnay/rust-toolchain@stable
153153
- name: Cache cargo (sindri build)
154-
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
154+
uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
155155
with:
156156
path: |
157157
~/.cargo/registry
@@ -175,7 +175,7 @@ jobs:
175175
fi
176176
- name: Upload lint report
177177
if: always()
178-
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
178+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
179179
with:
180180
name: registry-lint-report
181181
path: v4/lint-report.json
@@ -204,7 +204,7 @@ jobs:
204204
ref: v4
205205
- uses: dtolnay/rust-toolchain@stable
206206
- name: Cache cargo (sindri build)
207-
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
207+
uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
208208
with:
209209
path: |
210210
~/.cargo/registry
@@ -283,7 +283,7 @@ jobs:
283283
python-version: "3.12"
284284

285285
- name: Cache ScanCode pip install
286-
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
286+
uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
287287
with:
288288
path: ~/.cache/pip
289289
key: ${{ runner.os }}-scancode-32.x
@@ -395,7 +395,7 @@ jobs:
395395
396396
- name: Upload ScanCode report
397397
if: ${{ always() || github.event.inputs.debug_scancode == 'true' }}
398-
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
398+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
399399
with:
400400
name: scancode-license-report
401401
path: |
@@ -421,7 +421,7 @@ jobs:
421421
ref: v4
422422
- uses: dtolnay/rust-toolchain@stable
423423
- name: Cache cargo (sindri build)
424-
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
424+
uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
425425
with:
426426
path: |
427427
~/.cargo/registry
@@ -465,7 +465,7 @@ jobs:
465465
test -s "$out" || { echo "::error::index.yaml is empty"; exit 1; }
466466
echo "index-path=v4/$out" >> "$GITHUB_OUTPUT"
467467
- name: Upload generated index
468-
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
468+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
469469
with:
470470
name: registry-core-index
471471
path: v4/registry-core/index.yaml
@@ -483,7 +483,7 @@ jobs:
483483
if: ${{ needs.resolve-tag.outputs.dry_run == 'false' }}
484484
steps:
485485
- name: Install oras
486-
uses: oras-project/setup-oras@22ce207df3b08e061f537244349aac6ae1d214f6 # v1.2.4
486+
uses: oras-project/setup-oras@38de303aac69abb66f3e6255b7198bff35f323e3 # v2.0.0
487487
with:
488488
version: ${{ env.ORAS_VERSION }}
489489
- name: Login to ghcr.io (read)
@@ -523,7 +523,7 @@ jobs:
523523
name: registry-core-index
524524
path: v4/registry-core/
525525
- name: Install oras
526-
uses: oras-project/setup-oras@22ce207df3b08e061f537244349aac6ae1d214f6 # v1.2.4
526+
uses: oras-project/setup-oras@38de303aac69abb66f3e6255b7198bff35f323e3 # v2.0.0
527527
with:
528528
version: ${{ env.ORAS_VERSION }}
529529
- name: Login to ghcr.io
@@ -638,7 +638,7 @@ jobs:
638638

639639
- name: Generate SLSA provenance attestation
640640
id: attest
641-
uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2.4.0
641+
uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
642642
with:
643643
# Subject is the OCI artifact identified by its manifest digest.
644644
# We provide both the digest (for OCI attestation lookup) and the
@@ -653,7 +653,7 @@ jobs:
653653
show-summary: true
654654

655655
- name: Upload attestation bundle
656-
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
656+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
657657
with:
658658
name: slsa-provenance-bundle
659659
path: ${{ steps.attest.outputs.bundle-path }}
@@ -757,7 +757,7 @@ jobs:
757757
758758
- name: Upload verification result
759759
if: always()
760-
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
760+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
761761
with:
762762
name: attestation-verify-result
763763
path: attestation-verify-result.json

0 commit comments

Comments
 (0)