nushell/.github/workflows/audit.yml

26 lines
494 B
YAML
Raw Normal View History

Don't use `oldtime` feature of chrono (#9577) <!-- if this PR closes one or more issues, you can automatically link the PR with them by using one of the [*linking keywords*](https://docs.github.com/en/issues/tracking-your-work-with-issues/linking-a-pull-request-to-an-issue#linking-a-pull-request-to-an-issue-using-a-keyword), e.g. - this PR should close #xxxx - fixes #xxxx you can also mention related issues, PRs or discussions! --> # Description `chrono` crate enables `oldtime` feature by default, which has a vulnerability (https://rustsec.org/advisories/RUSTSEC-2020-0071). This PR tries to remove `time` v0.1.45 completely from nu and add an audit CI to check for security vulnerabilities. :hand: Wait for the following PRs: - [x] https://github.com/nushell/reedline/pull/599 - [x] https://github.com/bspeice/dtparse/pull/44 - [x] https://github.com/Byron/trash-rs/pull/75 - [x] https://gitlab.com/imp/chrono-humanize-rs/-/merge_requests/15 # User-Facing Changes <!-- List of all changes that impact the user experience here. This helps us keep track of breaking changes. --> # Tests + Formatting <!-- Don't forget to add tests that cover your changes. Make sure you've run and fixed any issues with these commands: - `cargo fmt --all -- --check` to check standard code formatting (`cargo fmt --all` applies these changes) - `cargo clippy --workspace -- -D warnings -D clippy::unwrap_used -A clippy::needless_collect -A clippy::result_large_err` to check that you're using the standard code style - `cargo test --workspace` to check that all tests pass - `cargo run -- crates/nu-std/tests/run.nu` to run the tests for the standard library > **Note** > from `nushell` you can also use the `toolkit` as follows > ```bash > use toolkit.nu # or use an `env_change` hook to activate it automatically > toolkit check pr > ``` --> # After Submitting <!-- If your PR had any user-facing changes, update [the documentation](https://github.com/nushell/nushell.github.io) after the PR is merged, if necessary. This will help us keep the docs up to date. --> --------- Co-authored-by: sholderbach <sholderbach@users.noreply.github.com>
2023-08-25 10:54:01 +02:00
name: Security audit
on:
pull_request:
paths:
- '**/Cargo.toml'
- '**/Cargo.lock'
push:
branches:
- main
env:
RUST_BACKTRACE: 1
CARGO_TERM_COLOR: always
CLICOLOR: 1
jobs:
security_audit:
runs-on: ubuntu-latest
# Prevent sudden announcement of a new advisory from failing ci:
continue-on-error: true
steps:
- uses: actions/checkout@v4
Don't use `oldtime` feature of chrono (#9577) <!-- if this PR closes one or more issues, you can automatically link the PR with them by using one of the [*linking keywords*](https://docs.github.com/en/issues/tracking-your-work-with-issues/linking-a-pull-request-to-an-issue#linking-a-pull-request-to-an-issue-using-a-keyword), e.g. - this PR should close #xxxx - fixes #xxxx you can also mention related issues, PRs or discussions! --> # Description `chrono` crate enables `oldtime` feature by default, which has a vulnerability (https://rustsec.org/advisories/RUSTSEC-2020-0071). This PR tries to remove `time` v0.1.45 completely from nu and add an audit CI to check for security vulnerabilities. :hand: Wait for the following PRs: - [x] https://github.com/nushell/reedline/pull/599 - [x] https://github.com/bspeice/dtparse/pull/44 - [x] https://github.com/Byron/trash-rs/pull/75 - [x] https://gitlab.com/imp/chrono-humanize-rs/-/merge_requests/15 # User-Facing Changes <!-- List of all changes that impact the user experience here. This helps us keep track of breaking changes. --> # Tests + Formatting <!-- Don't forget to add tests that cover your changes. Make sure you've run and fixed any issues with these commands: - `cargo fmt --all -- --check` to check standard code formatting (`cargo fmt --all` applies these changes) - `cargo clippy --workspace -- -D warnings -D clippy::unwrap_used -A clippy::needless_collect -A clippy::result_large_err` to check that you're using the standard code style - `cargo test --workspace` to check that all tests pass - `cargo run -- crates/nu-std/tests/run.nu` to run the tests for the standard library > **Note** > from `nushell` you can also use the `toolkit` as follows > ```bash > use toolkit.nu # or use an `env_change` hook to activate it automatically > toolkit check pr > ``` --> # After Submitting <!-- If your PR had any user-facing changes, update [the documentation](https://github.com/nushell/nushell.github.io) after the PR is merged, if necessary. This will help us keep the docs up to date. --> --------- Co-authored-by: sholderbach <sholderbach@users.noreply.github.com>
2023-08-25 10:54:01 +02:00
- uses: rustsec/audit-check@v1.4.1
with:
token: ${{ secrets.GITHUB_TOKEN }}