[pacphi]

Summary

This PR prepares the v3.1.4 patch release from the v3.1.x maintenance branch. There is no release candidate. It also moves v3.1.x onto the owner's dependency-audit standard. #385's security fixes are already on the branch; this PR adds the audit standard, the release-workflow fixes and the version bump.

No tag is created here. The tag is pushed after merge; see "Tagging" below.

Commits

1. ci(v3.1.x): standard Dependency Audit with native .cargo/audit.toml

• Ignores moved. The 3 ignores in v3/audit-ignore now live in v3/.cargo/audit.toml under [advisories] ignore, and v3/audit-ignore is deleted. Each entry keeps its path, reasoning, reachability and exit condition, and now also has its RustSec link.
• Job renamed. Security Audit becomes Dependency Audit. The new job:
  • pins cargo-audit to 0.22.2: cargo binstall --locked cargo-audit@0.22.2, with a SHA-pinned cargo-bins/cargo-binstall v1.17.7;
  • runs cargo audit --deny warnings in v3/;
  • has no if:, and the run-audit dispatch input is removed.
• Path filters dropped from ci-v3.yml (deliberate). Every push and PR on v3.1.x now runs the workflow:
  • The required Dependency Audit check always reports, so no PR can wait forever on a check that never runs.
  • Every push to v3.1.x builds the CI image that the release promotes.
  • The cost is that every v3.1.x PR now runs the full v3 matrix (images, k8s).
• Audit failures fail the aggregates. CI v3 Required Checks and CI v3 Status both fail when Dependency Audit is anything but success.
• Trivy pinned. aquasecurity/trivy-action is pinned to ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0, which is the annotated tag dereferenced to its commit. It also sets version: v0.76.0, the newest Trivy release at least 3 days old; v0.76.1 came out 2026-10-21T11:18Z.
• make v3-audit. .github/scripts/v3/cargo-audit.sh now runs the same command, and make v3-audit installs cargo-audit --version 0.22.2 --locked.

2. ci(v3.1.x): release the v3 line from v3.1.x

• mark-passed (in ci-v3.yml) now runs for pushes to refs/heads/v3.1.x as well as main. This produces v3-ci-passed-<sha>-{ubuntu,fedora,opensuse}, the images verify-ci-image looks for first.
• update-version-files (in release-v3.yml):
  • It checks out ref: v3.1.x instead of main and pushes HEAD:v3.1.x.
  • A new guard step. The old logic skipped only the CHANGELOG step. It then still bumped Cargo.toml to 3.1.5, re-resolved the whole lockfile with cargo generate-lockfile, and tried to push. Now, when v3/CHANGELOG.md already has ## [<version>] and [workspace.package] version already equals the tag version, the job skips every later step: download, changelog, bump, toolchain, lockfile regeneration, commit and push. The job still succeeds.
  • Both hold for 3.1.4 after this PR. I simulated the guard locally: 3.1.4 gives skip=true and 3.1.5 gives skip=false.
• Floating actions SHA-pinned in the jobs touched here (mark-passed, verify-ci-image, publish-npm, update-version-files), in main's @<sha> # vX.Y.Z style:
  • checkout v6.1.0, setup-node v4.4.0, download-artifact v8.0.2, rust-toolchain stable @ b725eda (2026-10-16).
  • docker/login-action is pinned to v4.6.0, because @v4 now resolves to v4.7.0 (published 2026-10-23T15:22Z, under 3 days old).

3. chore(v3.1.x): prepare v3.1.4

• Cargo. The v3/Cargo.toml workspace version goes 3.1.3 → 3.1.4, and all 12 crates inherit it. v3/Cargo.lock was updated with cargo update -w, which changes only the 12 sindri-* version lines.
• rust-version goes "1.94" → "1.94.1". aws-sdk-s3 ≥ 1.140 and the matching aws-* crates already require it, and rust-toolchain.toml already pins 1.94.1. This is a patch-level change.
• npm packages. Every packages/@pacphi/sindri-cli*/package.json version, and the wrapper's 5 optionalDependencies, go 3.1.0 → 3.1.4.
• v3/CHANGELOG.md gets a ## [3.1.4] - 2026-10-23 entry summarizing deps(v3.1.x): consolidate dependency updates and security fixes #385's security fixes and this PR. Prettier also normalized blank lines in older entries (whitespace only), because the pre-commit prettier --check requires it.

4. docs(v3.1.x): describe 3.1.4 as a v3.1.x patch release in the CHANGELOG

• Rewords the entry's opening line. SECURITY.md keeps v3 supported with ongoing v3.1.x releases, so the entry no longer calls 3.1.4 the line's "final" release.

5. ci(v3.1.x): pin release actions

• Every action in release-v3.yml is now pinned by commit SHA with a # vX.Y.Z comment. Each is at the newest release in its major (0.x: minor) that is at least 3 days old.
• Most pins are the same commits the floating tags resolve to today.
• Two pins change what runs:
  • docker/login-action is pinned to v4.6.0; @v4 now points at v4.7.0, which is under 3 days old.
  • sigstore/cosign-installer moves from v4.1.0 to v4.1.2.
• make_latest is unchanged, so v3.1.4 becomes GitHub's Latest release.

Audit

Check	Result
cd v3 && cargo audit --deny warnings with only .cargo/audit.toml (cargo-audit 0.22.2, 1351 advisories, 599 crates)	exit 0
Same command with .cargo/audit.toml removed (control)	fails on exactly RUSTSEC-2026-0374, -0173 and 2024-0449
Vulnerabilities ignored	none; all 3 ignores are unmaintained warnings

What release-v3.yml will do for tag v3.1.4

The tag push runs the workflow file as of the tagged commit, which is this branch's version of the file.

Job	Action
validate-tag	version=3.1.4, is_prerelease=false
generate-changelog	Commits in v3.1.3..v3.1.4 touching v3/; this becomes the GitHub Release body (not the CHANGELOG.md entry)
build-binaries	linux x86_64, linux aarch64 (cross), macOS aarch64, windows x86_64; rustc 1.94.1 from v3/rust-toolchain.toml; binaries report sindri 3.1.4
verify-ci-image	Looks for v3-ci-passed-<tagged sha>-ubuntu, then v3-ci-<sha>-ubuntu, then up to 10 ancestors with no container-affecting change
promote-image	Re-tags the CI images (no rebuild) for ubuntu, fedora and opensuse; see the tag list below
sign-image	cosign sign --yes (keyless, by digest) for 3.1.4-{ubuntu,fedora,opensuse}
attest-provenance	actions/attest-build-provenance for each distro's 3.1.4-<distro> digest
generate-sbom	SPDX SBOM of :3.1.4, attached with cosign attach sbom, and uploaded as an artifact
publish-npm	Platform packages and the wrapper; see the details below
update-version-files	Checks out v3.1.x; the guard finds [3.1.4] and Cargo 3.1.4, so it skips without pushing
create-release	"Sindri v3.1.4 (Rust)", not a prerelease, so it becomes GitHub's "Latest". Assets: 4 binaries, .sha256 files, checksums.txt, install-v3.sh, VERIFY.md, sbom.spdx.json
notify-release	Logs success; opens an issue on failure

promote-image tags:

• Every distro: 3.1.4-<d>, 3.1-<d>, 3-<d>, <d>, latest-<d>.
• ubuntu only: also 3.1.4, 3.1, 3, v3, v3-latest, latest.
• Registries: GHCR always; Docker Hub only if DOCKERHUB_USERNAME and DOCKERHUB_TOKEN are set, and neither is a repository secret today.

publish-npm:

• npm publish --provenance --access public --tag latest for @pacphi/sindri-cli-{linux-x64,linux-arm64,darwin-arm64,win32-x64}@3.1.4, then for the @pacphi/sindri-cli@3.1.4 wrapper.
• Today latest points to 3.1.3 for all of them.
• @pacphi/sindri-cli-darwin-x64 is in the wrapper's optionalDependencies but is never built or published. That was already true for 3.1.3. npm skips the missing optional package, and npm install @pacphi/sindri-cli@3.1.3 works, but Intel Macs get no binary.

Tagging

• Tag the commit this PR becomes on v3.1.x (git rev-parse origin/v3.1.x right after merge).
• Wait first. Before pushing the tag, wait until that commit's own v3: CI push run has finished Mark Promotion Candidates.
• Push nothing else to v3.1.x in between. ci-v3 uses cancel-in-progress, and no v3.1.x commit has a v3-ci-passed-* image yet. The ancestor fallback also stops at this PR, because it changes v3/.

Unverified / for the owner

• Can't run before a tag: build-binaries (especially the cross aarch64 build, which installs cross from git HEAD), the npm publish, cosign signing and the attestations.
• NPM_TOKEN was last updated 2026-03-21. Confirm it is still valid at npmjs.com before tagging. If it isn't, publish-npm fails after the images have already been promoted.
• v3/CHANGELOG.md has no [3.1.3] entry: the release bot pushed that one to main. I didn't backfill it.
• Hooks. Pre-commit hooks ran on every commit with PNPM_CONFIG_VERIFY_DEPS_BEFORE_RUN=false, because of the known pnpm.overrides issue.

🤖 Generated with Claude Code