mirror of
https://github.com/telemt/telemt.git
synced 2026-06-19 02:00:08 +07:00
David Osipov
2bd9036908
- Add deny.toml with license/advisory policy for cargo-deny - Add security.yml GitHub Actions workflow for automated audit - Update rust.yml with hardened clippy lint enforcement - Update Cargo.toml/Cargo.lock with audit-related dependency additions - Fix clippy lint placement in config.toml (Clippy lints must not live in rustflags) Part of PR-SEC-1: no Rust source changes, establishes CI gates for all subsequent PRs.
34 lines
694 B
YAML
34 lines
694 B
YAML
name: Security
|
|
|
|
on:
|
|
push:
|
|
branches: [ "*" ]
|
|
pull_request:
|
|
branches: [ "*" ]
|
|
|
|
env:
|
|
CARGO_TERM_COLOR: always
|
|
|
|
jobs:
|
|
advisory-gate:
|
|
name: Advisory Gate
|
|
runs-on: ubuntu-latest
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Install latest stable Rust toolchain
|
|
uses: dtolnay/rust-toolchain@stable
|
|
|
|
- name: Install cargo-audit
|
|
run: cargo install --locked cargo-audit
|
|
|
|
- name: Run policy regression tests
|
|
run: bash tools/security/test_enforce_audit_policy.sh
|
|
|
|
- name: Enforce advisory policy
|
|
run: bash tools/security/enforce_audit_policy.sh |