[duncanista]

Overview

Jira: SVLS-9974

The Audit job fails on the next PR. RustSec published advisories for zstd, zstd-safe and
zstd-sys (RUSTSEC-2026-0391, 0398, 0403, 0410) and for tokio (RUSTSEC-2026-0386). None of them
applies to bottlecap: the zstd crates only compress, the one decoder reads the embedded AppSec
ruleset, the seekable feature is off, and 0410 is wasm32 only. The real fix is zstd 0.14 in
serverless-components and libdatadog.

This PR replaces rustsec/audit-check with cargo deny --locked check:

• bottlecap/deny.toml holds one ignore list, with a reason per entry. It also checks
  duplicate versions (warn, with the holder of each skip named), sources (crates.io and the
  DataDog GitHub org) and licenses (the current set plus the OpenSSL exception for
  aws-lc-fips-sys). The graph uses all features and the 4 Linux targets that ship.
• The job keeps the check name Audit, which branch protection on main requires.
• bottlecap/.cargo/audit.toml goes away. The old action read it from the repo root, so CI
  never loaded it.
• Comments in Cargo.toml and .trivyignore.yaml now point at deny.toml. The Trivy
  lockfile scan stays as the second advisory source.
• The taiki-e/install-action pin moves from v2.69.9 to v2.87.28 (2026-10-12) for the
  cargo-deny install. The same bump changes the nextest install of the required "Test Suite"
  job (still nextest@0.9).

Size: 199 core lines, 199 lines in total.

Testing

• applies on the previous PR of the stack: pass
• cargo metadata --locked: pass
• cargo deny --locked check: pass
• dd-rust-license-tool check: pass
• actionlint 1.7.12 with shellcheck 0.10.0 on the changed workflows: pass

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-28T19:03:06.029097Z	—	PR opened
🔒 Security Review	✅ Completed 2026-10-28T19:03:21.715098Z	26f7ded	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[Copilot]

🟢 Approval recommended

The migration from cargo-audit to cargo-deny has no active review issues requiring further changes.

No open issues 🎉

What changed in this PR

Replaces cargo-audit with cargo-deny for the Lambda extension’s Rust dependency checks, while preserving the required Audit check name and the separate Trivy scan.

Changes:

• Adds a centralized policy for advisories, duplicate dependencies, sources, and licenses across all features and four shipping Linux targets.
• Updates CI to run cargo deny --locked check and bumps the install-action pin used for cargo-deny and nextest.
• Removes the old audit configuration and updates comments to reference cargo-deny.

File	Description
bottlecap/​deny.toml	Defines dependency policies and documented advisory exceptions.
bottlecap/​Cargo.toml	Updates comments to reference cargo-deny and its configuration.
bottlecap/​.cargo/​audit.toml	Removes the superseded cargo-audit configuration.
.trivyignore.yaml	Updates explanatory text to point to the new ignore configuration.
.github/​workflows/​rs_ci.yml	Replaces the audit action with cargo-deny and updates install-action pins.

_{Review effort: Balanced}