mirror of
https://github.com/Twigpine/node.git
synced 2026-11-09 05:20:05 -10:00
beardthelion
7533b74f79
* ci: harden PR pipeline (audit, MSRV, release build, beta matrix, docker smoke) Restructure the single stable-only fmt+clippy+test job into separate jobs: fmt+clippy (stable), a test matrix on stable+beta (beta non-blocking), build --release, cargo audit, an MSRV check pinned to Rust 1.91, and a Docker build smoke test mirroring the release workflow. Add concurrency cancellation for superseded PR runs and per-job timeouts. Declare rust-version = "1.91" in [workspace.package] and inherit it in every member crate so the stated MSRV is a real, CI-enforced contract. * ci: disable credential persistence on checkout steps Set persist-credentials: false on all six actions/checkout steps. These jobs run untrusted PR code via cargo and docker build, and checkout's default leaves the GITHUB_TOKEN in the local git config where that code could read it. None of the jobs push or otherwise need git credentials. * fix(deps): bump rustls-webpki to 0.103.13 Clears three advisories flagged by the new cargo audit job: a reachable panic in CRL parsing and two name-constraint bypasses (wildcard and URI). Semver-compatible patch, lockfile only, no manifest or code change. cargo also corrects a stale lockfile reference while rewriting Cargo.lock: data-encoding-macro-internal 0.1.17 (a build-time macro crate) requires syn 1.x, and its dependency entry is re-pinned from syn 2.0.117 to the 1.0.109 it actually resolves to. Unrelated to the bump, unavoidable when cargo touches the lock, and the more-correct state. * ci(audit): suppress no-fix advisories with justification and a re-check The cargo audit job stays hard-fail. The remaining three advisories have no available upstream fix, so they are suppressed in .cargo/audit.toml (the location cargo-audit actually reads; a repo-root audit.toml is not read), each with an inline rationale and removal condition: - RUSTSEC-2026-0118/0119 (hickory-proto 0.25.2, via libp2p-dns 0.44): reachable, since the node wraps QUIC in the system DNS resolver. No fix until libp2p-dns ships hickory 0.26. Accepted, reachable risk. - RUSTSEC-2023-0071 (rsa Marvin): in the lockfile via sqlx's unconditional sqlx-mysql, but not linked (sqlx is postgres-only), so no RSA oracle exists; no upstream fix regardless. Two controls keep the suppression honest. The PR audit job echoes the active ignore list to the job summary, so a green check is not read as advisory-clean. A weekly scheduled job re-runs cargo audit without the ignores for visibility and hard-fails if hickory-proto moves off 0.25.x while the ignores remain, so the suppression cannot silently outlive the upstream fix. * ci(audit): reference tracking issue #76 in the hickory ignores * ci(audit): treat hickory-proto removal as drift too The scheduled drift guard only failed when hickory-proto was present and off 0.25.x, so removing it from Cargo.lock entirely left the RUSTSEC-2026-0118 /0119 ignores in place with the guard still passing. Treat an absent version as drift as well, so dead ignore entries are caught whether the dependency is bumped past 0.25.x or removed.
51 lines
1.2 KiB
TOML
51 lines
1.2 KiB
TOML
[workspace]
|
|
resolver = "2"
|
|
members = [
|
|
"crates/gitlawb-core",
|
|
"crates/gitlawb-node",
|
|
"crates/gl",
|
|
"crates/git-remote-gitlawb",
|
|
"crates/gitlawb-attest",
|
|
]
|
|
|
|
[workspace.package]
|
|
version = "0.3.9"
|
|
edition = "2021"
|
|
rust-version = "1.91"
|
|
license = "MIT OR Apache-2.0"
|
|
authors = ["gitlawb contributors"]
|
|
repository = "https://github.com/gitlawb/node"
|
|
|
|
[workspace.dependencies]
|
|
# async
|
|
tokio = { version = "1", features = ["full"] }
|
|
# serialization
|
|
serde = { version = "1", features = ["derive"] }
|
|
serde_json = "1"
|
|
serde_jcs = "0.2"
|
|
# errors
|
|
thiserror = "2"
|
|
anyhow = "1"
|
|
# crypto
|
|
ed25519-dalek = { version = "2", features = ["rand_core", "pkcs8", "pem"] }
|
|
rand = "0.8.6"
|
|
sha2 = "0.10"
|
|
# encoding
|
|
hex = "0.4.3"
|
|
base64 = "0.22"
|
|
multibase = "0.9"
|
|
multihash = { version = "0.19", features = ["std"] }
|
|
multihash-codetable = { version = "0.1", features = ["sha2"] }
|
|
cid = "0.11"
|
|
# logging
|
|
tracing = "0.1"
|
|
tracing-subscriber = { version = "0.3", features = ["env-filter"] }
|
|
# time
|
|
chrono = { version = "0.4", features = ["serde"] }
|
|
# uuid
|
|
uuid = { version = "1", features = ["v4"] }
|
|
# http client
|
|
reqwest = { version = "0.12", features = ["blocking", "json", "multipart", "rustls-tls"], default-features = false }
|
|
# HMAC
|
|
hmac = "0.12"
|