Conversation
…B-1152) yanked: enforced — cargo audit --deny yanked on the weekly schedule run, where advisories against an unchanged lockfile belong; PR/push runs keep the warning so an upstream yank never blocks unrelated PRs. The schedule leg now also proves the yank check ran (cargo-audit 0.22.1 silently skips it and exits 0 when the crates.io index is unreachable — verified). unsound / unmaintained: stay warnings on every event. Neither class guarantees a fixed version exists (rand 0.8.5 via fred 9.4 + memcache 0.19 has no compatible upgrade today), so enforcement means an ignore-list treadmill. deny.toml scopes stay narrow: cargo audit already reports every transitive case from the verbatim lockfile each run. deny.toml's untracked TODO is replaced by the decision of record; README table and Makefile follow. cargo update -p chacha20 clears the one yanked crate (0.10.1 -> 0.10.2) so the enforced class is born green.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Team Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (4)
Included review availability: 0 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 3 reviews per hour. WalkthroughThe pull request adds event-specific ChangesSupply-chain audit enforcement
Priority: ⬇️ Low Estimated code review effort: 3 (Moderate) | ~20 minutes Change: Other Sequence Diagram(s)sequenceDiagram
participant GitHubActions as GitHub Actions
participant CargoAudit as cargo-audit
participant CratesIo as crates.io
GitHubActions->>CargoAudit: Run cargo audit with event-specific flags
CargoAudit->>CratesIo: Query advisory and package data
CratesIo-->>CargoAudit: Return advisory and yank results
CargoAudit-->>GitHubActions: Stream and record audit output
GitHubActions->>GitHubActions: Apply scheduled-run enforcement
Merge Risk: ⚪ Minimal · up to The supply-chain audit policy changes are aligned across CI, local commands, and documentation, with no unresolved merge-blocking risk identified. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
This comment has been minimized.
This comment has been minimized.
![kodus-27b[bot]](https://avatars.githubusercontent.com/u/223823690?s=60&v=4){kind=small}
…lure (LAB-1152) Kody flagged the proof-of-run guard as brittle on a warm index cache. The premise is wrong — cargo-audit 0.22.1 prints 'Updating crates.io index' unconditionally before the fetch attempt (auditor.rs), so a fresh cache cannot suppress it; verified empirically cold and warm. But the review surfaced a real hole in the opposite direction: on index fetch/open failure the tool warns "couldn't update|open crates.io index", skips the yank check entirely, and exits 0 — and the guard's failure grep only matched "couldn't check", so the weekly enforcing run would go green on a skipped check (the attempt line prints before the failed fetch). Broaden the failure grep to all three skip signals; keep the attempt-line grep, which is what catches the check being disabled outright (e.g. a future -n).
|
@kody start-review |
Kody Review CompleteGreat news! 🎉 Keep up the excellent work! 🚀 Kody Guide: Usage and ConfigurationInteracting with Kody
Current Kody ConfigurationReview OptionsThe following review options are enabled or disabled:
|
…se (LAB-3406) clippy 1.99 (beta) fires double_must_use nine times through the bare #[must_use] that async-trait 0.1.89 emits on its Pin<Box<dyn Future>> methods (rust-clippy#17529). async-trait 0.1.92 stopped emitting it (dtolnay/async-trait#303). Lockfile-only; the transitive syn 3 entry is pinned to 3.0.4 so the hunk is byte-identical to main (92637cc), which took the same bump — keeps the PR mergeable without a lockfile conflict.
|
Pushed 0a3a93e to clear the red |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
1 participant
Closes LAB-1152.
Decision per advisory class
yankedschedulerun (cargo audit --deny yanked); warn on PR/pushcargo update -p; enforcement lives on the audit side because cargo-deny's feature-resolved graph pruned the actual yanked crate (chacha20, behind reqwest's unused quinn path) while audit saw it.unsoundunmaintaineddeny.tomlscopes stay narrow — widening to "all" would only duplicate what audit already reports from the verbatim lockfile every run.deny.toml's untracked TODO ("widening both scopes toallis open work, not covered") is replaced by this decision of record. README table and Makefile updated to match;make auditruns the strict form so a local pass covers every CI event.Yanked check proven to execute — and now self-proving
cachekit-lean: run 33334234173 (green, 2026-08-30) showsUpdating crates.io indexfollowed byWarning: yankedin the audit step — the check runs on that runner and detects real yanks; it just exited 0.cargo audit --deny yankedsilently skips the yank check and exits 0 — no warning at all. Total network loss fails closed (advisory DB fetch errors out). Since the weekly run is the sole enforcement point, its leg now requires positive evidence (Updating crates.io indexpresent, nocouldn't checkwarning) and fails otherwise. Fail-closed brittleness is confined to the schedule event — a wording change in the pinned tool can only redden the weekly run, never a PR.Green-on-clean proof (local, pinned tool versions 0.19.4 / 0.22.1)
cargo update -p chacha20→ 0.10.1 (yanked) → 0.10.2 (not yanked; crates.io checksum verified; sole dependent rand 0.10.2 wants^0.10).cargo check --all-features --lockedpasses.cargo deny --locked --all-features check→ exit 0:advisories ok, bans ok, licenses ok, sources ok(--lockedand--all-featurespreserved).cargo audit --deny yanked→ exit 0,warning: 3 allowed warnings found(the three unsound advisories that stay warn by decision: anyhow, rand 0.8.5, scc).Notes
deny.tomlas single decision of record, fixed the stale Makefile header, README row now covers push runs. No findings rejected.cargo audit; cachekit-core installs cargo-audit unpinned.Summary by CodeRabbit
Bug Fixes
Documentation