Skip to content

Latest commit

 

History

History
80 lines (65 loc) · 3.72 KB

README.md

File metadata and controls

80 lines (65 loc) · 3.72 KB
Raw

Audit Rust dependencies using the RustSec Advisory DB

Audit your Rust dependencies using cargo audit and the RustSec Advisory DB. The action creates a summary with all vulnerabilities. It can create issues for each of the found vulnerabilities.

Execution Summary:

The action reports any audit results.

Example workflow

name: "Audit Dependencies"
on:
  push:
    paths:
      # Run if workflow changes
      - '.github/workflows/audit.yml'
      # Run on changed dependencies
      - '**/Cargo.toml'
      - '**/Cargo.lock'
      # Run if the configuration file changes
      - '**/audit.toml'
  # Rerun periodicly to pick up new advisories
  schedule:
    - cron: '0 0 * * *'
  # Run manually
  workflow_dispatch:

jobs:
  audit:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      issues: write
    steps:
      - uses: actions/checkout@v4
      - uses: actions-rust-lang/audit@v1
        name: Audit Rust Dependencies
        with:
          # Comma separated list of issues to ignore
          ignore: RUSTSEC-2020-0036

Inputs

All inputs are optional. Consider adding an audit.toml configuration file to your repository for further configurations. cargo audit supports multiple warning types, such as unsound code or yanked crates. Configuration is only possible via the informational_warnings parameter in the configuration file (#318). Setting denyWarnings to true will also enable these warnings, but each warning is upgraded to an error.

Name Description Default
TOKEN The GitHub access token to allow us to retrieve, create and update issues (automatically set). github.token
denyWarnings Any warnings generated will be treated as an error and fail the action. false
file The path to the Cargo.lock file to inspect file.
ignore A comma separated list of Rustsec IDs to ignore.
createIssues Create/Update issues for each found vulnerability. By default only on main or master branch. github.ref == 'refs/heads/master' || github.ref == 'refs/heads/main'
workingDirectory Run cargo audit from the given working directory

Dependencies

The action works best on the GitHub-hosted runners, but can work on self-hosted ones too, provided the necessary dependencies are available. PRs to add support for more environments are welcome.

  • bash
  • Python 3.9+
    • requests
  • Rust stable
    • cargo
  • use node actions

License

The scripts and documentation in this project are released under the MIT License.