From 043594fdebf8b96a3d5201fb72a83df4b8479cac Mon Sep 17 00:00:00 2001 From: Douglas Eichelberger Date: Wed, 19 Aug 2026 11:26:52 -0700 Subject: [PATCH] Fix the security audit workflow and move it off Node 20 The `audit` job has been failing at the tooling stage, never reaching an actual audit. `actions-rs/audit-check@v1` builds cargo-audit with `cargo install`, and that no longer compiles on the runner's toolchain: error: failed to compile `cargo-audit v0.22.2` Caused by: rustc 1.92.0 is not supported by the following package: kstring@2.0.4 requires rustc 1.96.0 `actions-rs` has been unmaintained for years. Its successor, `rustsec/audit-check`, still calls `findOrInstall("cargo-audit")` and so hits the same wall, and it targets Node 20 as well. Install a prebuilt cargo-audit from the upstream GitHub releases via `taiki-e/install-action` instead and invoke `cargo audit` directly. That skips the compile entirely, so the job no longer depends on the runner's rustc being new enough to build cargo-audit's dependency tree. Also moves the workflow off Node 20, which the runner now force-upgrades to Node 24 with a deprecation warning: - `actions/checkout@v2` -> `@v5`, which targets Node 24 natively - `taiki-e/install-action` is a composite action, so it has no Node runtime at all No action in this workflow targets Node 20 any more. Dropped the `checks: write` and `issues: write` permissions, which existed for the old action's annotation and issue-filing behaviour. Running `cargo audit` directly only needs `contents: read`; a failure now surfaces as a failed step rather than an annotation. Verified `cargo audit` exits 0 against the current Cargo.lock (230 dependencies, no advisories), so this should report green rather than trade a tooling failure for a findings failure. --- .github/workflows/audit.yml | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml index 0eac258..680dc11 100644 --- a/.github/workflows/audit.yml +++ b/.github/workflows/audit.yml @@ -12,12 +12,14 @@ on: jobs: audit: permissions: - checks: write contents: read - issues: write runs-on: ubuntu-latest steps: - - uses: actions/checkout@v2 - - uses: actions-rs/audit-check@v1 + - uses: actions/checkout@v5 + # Installs a prebuilt cargo-audit from the upstream GitHub releases. + # `actions-rs/audit-check` built it with `cargo install` instead, which + # broke once cargo-audit's dependencies outran the runner's toolchain. + - uses: taiki-e/install-action@v2 with: - token: ${{ secrets.GITHUB_TOKEN }} + tool: cargo-audit + - run: cargo audit