From e2a9b0780e1ccdc44aaccf09461ec9b65247a619 Mon Sep 17 00:00:00 2001 From: Yeji Han Date: Mon, 27 Jul 2026 11:58:18 +0900 Subject: [PATCH] fix(ci): generate lockfile before security audit rustsec/audit-check v2 no longer generates Cargo.lock. Create an ephemeral lockfile for the library audit and ignore advisories that only enter through dev dependencies pinned for backward-compatibility and integration tests. --- .github/workflows/audit.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml index 5e5149ac5a..b64f6f065f 100644 --- a/.github/workflows/audit.yml +++ b/.github/workflows/audit.yml @@ -21,7 +21,12 @@ jobs: steps: - name: Checkout source code uses: actions/checkout@v6 + - name: Generate Cargo lockfile + run: cargo generate-lockfile - name: Run security audit uses: rustsec/audit-check@v2 with: token: ${{ secrets.GITHUB_TOKEN }} + # The affected rustls-webpki version is only pulled in by dev dependencies + # pinned for backward-compatibility and integration tests. + ignore: RUSTSEC-2026-0098,RUSTSEC-2026-0099,RUSTSEC-2026-0104