[EliahKagan]

Note

AI disclosure: This PR description was written by GPT-6.1 Sol in Codex, at Eliah Kagan's direction. The LLM also prepared the changes and commit messages and performed the reported validation and reviews.

The advisory audit now uses the existing pinned EmbarkStudios/cargo-deny-action in a separate job, replacing the archived actions-rs/audit-check action. Unsound and unmaintained advisories are checked throughout the dependency graph, including transitive dependencies. Advisory failures fail the Security audit workflow, and it runs on every PR regardless of changed paths.

Both cargo-deny jobs use --workspace --all-features --locked, preserving committed dependency versions and covering the whole workspace. This removes cargo-audit installation, the Cargo wrapper that suppressed lockfile regeneration, and unnecessary checks/issues write permissions. The bans/licenses/sources job is also simplified by removing its single-entry matrix.

Removing the archived action resolves the finding behind zizmor code-scanning alert #149. This follows the replacement anticipated in #48 and #99.

Validation:

• Actionlint passes for the changed audit workflow, and git diff --check passes for the complete branch diff.
• Locally, cargo-deny 0.20.2 (the version bundled by the pinned action) passes advisories, bans, licenses, and sources with --workspace --all-features --locked --offline. The temporary configuration matches this PR's deny.toml except for pointing db-path at a copied advisory cache. The BSL-1.0 license-not-encountered warning occurs with both the baseline and updated configurations.
• A synthetic cargo-metadata fixture changes transitive tokio to 1.53.1 without changing the repository's lockfile. Its advisory check passes with cargo-deny's default unsound = "workspace" and fails with unsound = "all", reporting RUSTSEC-2026-0386. This compares cargo-deny scopes; it is not a test of the former cargo-audit action.
• Authenticated pedantic zizmor reports archived-uses on the baseline audit workflow and no findings on the updated audit workflow.
• Manual code and security review of the workflow and configuration diff found no actionable issues.
• All PR checks passed for commit 19a4824: Security audit, including both cargo_deny_advisories and cargo_deny; CI, including Linux, macOS, and Windows tests; CodeQL; and zizmor. These are successful pull_request runs in the upstream repository, including execution of the pinned Docker action.

The PR remains a draft. The advisory job has now passed on CI for this pull request.

[EliahKagan]

I've carefully read the code changes and commit messages, and the scan works. I'm fixing things up in the PR description (or having Codex do so) and I'll reread everything and merge once other CI passes.