From 8be3ee9ec9bc550a8fc8f1e00454d50b4db2e647 Mon Sep 17 00:00:00 2001 From: Nic-dorman Date: Wed, 28 Oct 2026 08:38:10 +0000 Subject: [PATCH 1/3] ci: make the daily security audit actually run The job was guarded by `repository_owner == 'maidsafe'`, so it has never run since the repo moved to WithAutonomi, and GitHub has since disabled the workflow for inactivity. It also used the deprecated actions-rs/audit-check. Run `cargo deny check advisories` instead: the same tool and deny.toml ignores as merge.yml's PR check, but daily, so new advisories show up between PRs. Add workflow_dispatch for manual runs. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/security_audit.yml | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/.github/workflows/security_audit.yml b/.github/workflows/security_audit.yml index fea01e080..a666a3aac 100644 --- a/.github/workflows/security_audit.yml +++ b/.github/workflows/security_audit.yml @@ -1,13 +1,20 @@ name: Security audit + +# Daily, so new advisories show up between PRs (merge.yml's cargo-deny only +# runs on pull requests). Same tool and deny.toml as the PR check. on: schedule: - cron: '0 0 * * *' + workflow_dispatch: + +permissions: + contents: read + jobs: audit: - if: github.repository_owner == 'maidsafe' runs-on: ubuntu-latest steps: - - uses: actions/checkout@v2 - - uses: actions-rs/audit-check@v1 + - uses: actions/checkout@v4 + - uses: EmbarkStudios/cargo-deny-action@v2 with: - token: ${{ secrets.GITHUB_TOKEN }} + command: check advisories From dec2a554511b1434aa3decdcf79e1ebe8c23b003 Mon Sep 17 00:00:00 2001 From: Nic-dorman Date: Wed, 28 Oct 2026 08:38:10 +0000 Subject: [PATCH 2/3] ci: run the benchmarks on demand only benchmark.yml ran on every pull_request and every push with no branch filter, so each push to a PR branch ran it twice. Nothing compares or stores the results, and merge.yml's `clippy --all-targets` already compiles the benches on every PR. Also drop the separate build step: its `if:` was a malformed expression and `cargo bench` builds anyway. Replace actions-rs/toolchain with dtolnay/rust-toolchain. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/benchmark.yml | 18 ++++++------------ 1 file changed, 6 insertions(+), 12 deletions(-) diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml index 5e891ce29..de70343ec 100644 --- a/.github/workflows/benchmark.yml +++ b/.github/workflows/benchmark.yml @@ -1,23 +1,21 @@ name: Benchmarking -on: [pull_request, push] +# On demand only. Nothing compares or stores the results, and merge.yml's +# `clippy --all-targets` already compiles the benches on every PR. +on: + workflow_dispatch: env: RUST_BACKTRACE: 1 RUSTFLAGS: "-D warnings" - jobs: bench: name: Benchmarking runs-on: ubuntu-latest steps: - - uses: actions/checkout@v2 - - uses: actions-rs/toolchain@v1 - with: - profile: minimal - toolchain: stable - override: true + - uses: actions/checkout@v4 + - uses: dtolnay/rust-toolchain@stable - name: Generate Cargo.lock run: cargo generate-lockfile @@ -32,9 +30,5 @@ jobs: target/ key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }} - - name: Cargo build - if: steps.${{ runner.os }}-cargo-build-target-${{ hashFiles('**/Cargo.lock') }}.outputs.cache-hit != 'true' - run: cargo build --release - - name: Cargo bench run: cargo bench From 8ddfd7f7cfc3eae3ff605153e9b97f554ffcd212 Mon Sep 17 00:00:00 2001 From: Nic-dorman Date: Wed, 28 Oct 2026 08:38:10 +0000 Subject: [PATCH 3/3] ci: keep release secrets out of run scripts, drop actions-rs release.yml pasted CRATES_IO_TOKEN and SELF_ENCRYPTION_PAT into the publish script with ${{ }}. Pass them through the step's env instead: release-plz publishes with CARGO_REGISTRY_TOKEN, so `cargo login` goes, and the PAT reaches --git-token as "$GIT_TOKEN". The publish job installed the toolchain twice; keep only dtolnay/rust-toolchain. Replace the deprecated actions-rs/toolchain in release.yml and merge.yml with dtolnay/rust-toolchain, and move actions/checkout from v2 to v4 to match the rest of the repo. Closes V2-1765 Co-Authored-By: Claude Opus 5.5 --- .github/workflows/merge.yml | 48 ++++++++++------------------------- .github/workflows/release.yml | 23 ++++++----------- 2 files changed, 21 insertions(+), 50 deletions(-) diff --git a/.github/workflows/merge.yml b/.github/workflows/merge.yml index d94cde361..96a8c5a91 100644 --- a/.github/workflows/merge.yml +++ b/.github/workflows/merge.yml @@ -14,13 +14,9 @@ jobs: matrix: os: [ubuntu-latest, windows-latest, macOS-latest] steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@v4 - name: Install Rust - uses: actions-rs/toolchain@v1 - with: - profile: minimal - toolchain: stable - override: true + uses: dtolnay/rust-toolchain@stable - uses: actions/cache@v4 with: @@ -39,12 +35,9 @@ jobs: name: Enforce Clippy constraints runs-on: ubuntu-latest steps: - - uses: actions/checkout@v2 - - uses: actions-rs/toolchain@v1 + - uses: actions/checkout@v4 + - uses: dtolnay/rust-toolchain@stable with: - profile: minimal - toolchain: stable - override: true components: clippy - uses: actions/cache@v4 @@ -64,11 +57,8 @@ jobs: name: Unused dependency check runs-on: ubuntu-latest steps: - - uses: actions/checkout@v2 - - uses: actions-rs/toolchain@v1 - with: - toolchain: nightly - override: true + - uses: actions/checkout@v4 + - uses: dtolnay/rust-toolchain@nightly - name: Run cargo-udeps uses: aig787/cargo-udeps-action@v1 @@ -79,19 +69,15 @@ jobs: cargo-deny: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@v4 - uses: EmbarkStudios/cargo-deny-action@v2 tests: name: Test runs-on: ubuntu-latest steps: - - uses: actions/checkout@v2 - - uses: actions-rs/toolchain@v1 - with: - profile: minimal - toolchain: stable - override: true + - uses: actions/checkout@v4 + - uses: dtolnay/rust-toolchain@stable - uses: actions/cache@v4 with: @@ -110,12 +96,8 @@ jobs: name: Test 32bit runs-on: ubuntu-latest steps: - - uses: actions/checkout@v2 - - uses: actions-rs/toolchain@v1 - with: - profile: minimal - toolchain: stable - override: true + - uses: actions/checkout@v4 + - uses: dtolnay/rust-toolchain@stable - name: Install 32bit target run: rustup target install i686-unknown-linux-gnu - name: Install GCC Multilib @@ -140,12 +122,8 @@ jobs: name: Dry run publish runs-on: ubuntu-latest steps: - - uses: actions/checkout@v2 - - uses: actions-rs/toolchain@v1 - with: - profile: minimal - toolchain: stable - override: true + - uses: actions/checkout@v4 + - uses: dtolnay/rust-toolchain@stable - name: Dry run publish run: cargo publish --dry-run diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 1a1bf2a51..f21876b9e 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -17,13 +17,9 @@ jobs: matrix: os: [ubuntu-latest, windows-latest, macOS-latest] steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@v4 - name: Install Rust - uses: actions-rs/toolchain@v1 - with: - profile: minimal - toolchain: stable - override: true + uses: dtolnay/rust-toolchain@stable - uses: actions/cache@v4 with: @@ -49,12 +45,6 @@ jobs: fetch-depth: "0" token: ${{ secrets.SELF_ENCRYPTION_PAT }} - uses: dtolnay/rust-toolchain@stable - - - uses: actions-rs/toolchain@v1 - with: - profile: minimal - toolchain: stable - override: true # This is required to allow `release-plz` to create tags - shell: bash @@ -66,8 +56,11 @@ jobs: - shell: bash run: cargo binstall --no-confirm release-plz + # Secrets go through env, not ${{ }} in the script. cargo reads + # CARGO_REGISTRY_TOKEN when release-plz publishes, so no `cargo login`. - name: publish crates shell: bash - run: | - cargo login "${{ secrets.CRATES_IO_TOKEN }}" - release-plz release --git-token ${{ secrets.SELF_ENCRYPTION_PAT }} + env: + CARGO_REGISTRY_TOKEN: ${{ secrets.CRATES_IO_TOKEN }} + GIT_TOKEN: ${{ secrets.SELF_ENCRYPTION_PAT }} + run: release-plz release --git-token "$GIT_TOKEN"