ci: ignore ratatui's transitive advisories in cargo-audit

The rustsec/audit-check action fails on any advisory (unmaintained + unsound),
unlike cargo-deny which only warns on these. ratatui's tree pulls in two:

  RUSTSEC-2024-0436 — paste (unmaintained, build-time proc-macro)
  RUSTSEC-2026-0002 — lru 0.12.5 (unsound IterMut; transitive)

Neither is fixable without dropping ratatui. Ignore both in the audit job
(mirroring deny.toml's paste policy) and grant the job checks:write so the
action can post its findings as a check run — the missing permission is what
turned the "2 warnings" into a hard "Resource not accessible" failure.

The lru advisory (dated 2026-01-07) only surfaced in CI because CI fetches a
fresh advisory DB; the local clone predated it.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: UnbreakableMJ

.github/workflows/ci.yml

@@ -66,12 +66,25 @@ jobs:
   audit:
     name: cargo-audit
     runs-on: ubuntu-latest
+    # audit-check posts findings as a check run — needs checks:write. Job-level
+    # permissions replace the default set, so contents:read is restated for
+    # checkout.
+    permissions:
+      contents: read
+      checks: write
     steps:
       - uses: actions/checkout@v5
       - uses: dtolnay/rust-toolchain@stable
       - uses: rustsec/audit-check@v2
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
+          # Build-time / transitive advisories from the ratatui TUI tree, kept in
+          # lock-step with deny.toml's policy (see that file for the paste
+          # rationale). Both are informational (no fix that doesn't mean dropping
+          # ratatui); revisit when ratatui's tree updates.
+          #   RUSTSEC-2024-0436 — paste (unmaintained, build-time proc-macro)
+          #   RUSTSEC-2026-0002 — lru 0.12.5 (unsound IterMut; transitive via ratatui)
+          ignore: RUSTSEC-2024-0436,RUSTSEC-2026-0002
 
   deny:
     name: cargo-deny

CHANGELOG.md

@@ -30,9 +30,13 @@ range may break in any release.
   - New modules `app` (state + pure nav/filter logic, 6 unit tests), `ui`
     (rendering + a `#RRGGBB`→`Color` theme helper over `vault_theme::steelbore`,
     2 `TestBackend` render smoke tests), and `client` (UDS request helper).
-  - `deny.toml` ignores **RUSTSEC-2024-0436** (`paste` unmaintained) — a
-    build-time-only proc-macro with no runtime surface, pulled in transitively
-    by `ratatui`; documented with a revisit note.
+  - Supply-chain: `ratatui`'s tree adds two informational advisories with no fix
+    short of dropping ratatui — **RUSTSEC-2024-0436** (`paste`, unmaintained
+    build-time proc-macro) and **RUSTSEC-2026-0002** (`lru` 0.12.5, unsound
+    `IterMut`, transitive). `paste` is ignored in `deny.toml`; the
+    `rustsec/audit-check` CI job ignores both (it fails on any advisory, unlike
+    `cargo deny`) and gains `checks: write` so it can post its check-run
+    annotations. Both documented with revisit notes.
 
 - **M4 (slice 4) — `--json` on the lifecycle verbs + a real `vault sync`.**
   Closes the two remaining M4 items.