Repository navigation
ci: add dependency-audit.yml workflow - #51
Conversation
Adds the required dependency-audit.yml workflow copied verbatim from petry-projects/.github/standards/workflows/dependency-audit.yml. Auto-detects ecosystems (npm, pnpm, Go, Cargo, Python) and runs the appropriate audit tool on PRs and pushes to main. Closes #21 Co-authored-by: don-petry <don-petry@users.noreply.github.com>
|
Warning Rate limit exceeded
Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 4 minutes and 13 seconds. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
|
@don-petry CI is green — all checks passing. This PR adds the required |
There was a problem hiding this comment.
Pull request overview
Adds the organization-required “Dependency audit” GitHub Actions workflow to bring the repository into compliance with issue #21 by automatically detecting common dependency ecosystems and running vulnerability audits on PRs and pushes to main.
Changes:
- Introduces
.github/workflows/dependency-audit.ymlto detect npm, pnpm, Go modules, Cargo, and Python dependency manifests. - Runs ecosystem-specific audit tools (
npm audit,pnpm audit,govulncheck,cargo audit,pip-audit) when corresponding files are present. - Uses SHA-pinned actions and minimal workflow permissions (
contents: read).
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| cargo: ${{ steps.check.outputs.cargo }} | ||
| pip: ${{ steps.check.outputs.pip }} | ||
| steps: | ||
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 |
There was a problem hiding this comment.
The pinned actions/checkout SHA here is also used in .github/workflows/codeql.yml but is annotated as # v4 there; having it labeled # v6.0.2 in this workflow is likely incorrect/misleading. Please update the version comment to match the actual release for this SHA (and keep it consistent across all actions/checkout uses in this file).
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4 |
| # cargo audit operates on Cargo.lock at workspace root | ||
| # For workspaces, a single audit at root covers all crates | ||
| status=0 |
There was a problem hiding this comment.
The comments state that cargo audit should run at the workspace root and that a single audit covers all crates, but the implementation below audits multiple directories. For Rust workspaces, please ensure the workflow audits only workspace roots (e.g., directories containing Cargo.lock and/or a Cargo.toml with [workspace]) to avoid duplicate/partial results and unnecessary failures.
| if ! (cd "$dir" && cargo generate-lockfile 2>/dev/null; cargo audit); then | ||
| status=1 | ||
| fi | ||
| echo "::endgroup::" | ||
| done < <(find . -name 'Cargo.toml' -not -path '*/target/*' -exec dirname {} \; | sort -u) |
There was a problem hiding this comment.
This loop iterates over every Cargo.toml directory (find ... Cargo.toml), which will include member crates inside a workspace. That can cause cargo audit to run from non-root manifests and fail or produce incomplete scans. Consider iterating unique Cargo.lock locations instead, and structure the subshell so cargo audit only runs after a successful cd into the intended directory.
| if ! (cd "$dir" && cargo generate-lockfile 2>/dev/null; cargo audit); then | |
| status=1 | |
| fi | |
| echo "::endgroup::" | |
| done < <(find . -name 'Cargo.toml' -not -path '*/target/*' -exec dirname {} \; | sort -u) | |
| if ! (cd "$dir" && cargo generate-lockfile 2>/dev/null && cargo audit); then | |
| status=1 | |
| fi | |
| echo "::endgroup::" | |
| done < <(find . -name 'Cargo.lock' -not -path '*/target/*' -exec dirname {} \; | sort -u) |
Summary
dependency-audit.ymlworkflow to satisfy the compliance requirement (issue Compliance: missing-dependency-audit.yml #21)petry-projects/.github/standards/workflows/dependency-audit.ymlmain; all actions are SHA-pinned per org policyCloses #21
Generated with Claude Code