ISCY/.github/workflows/apply-rustsec-fixes.yml at 0c50e728c245be416e10c905b9155ecc73717e31 · ewilhelm1979-netizen/ISCY · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
name: Apply reviewed RustSec fixes

on:
  pull_request:
    paths:
      - ".github/workflows/apply-rustsec-fixes.yml"

permissions:
  contents: write

jobs:
  apply:
    if: github.event.pull_request.head.repo.full_name == github.repository && github.head_ref == 'maintenance/application-readiness-v23.7.27'
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v6
        with:
          ref: ${{ github.head_ref }}
          persist-credentials: true
      - uses: dtolnay/rust-toolchain@stable
      - uses: taiki-e/install-action@v2
        with:
          tool: cargo-audit,cargo-deny
          fallback: none
      - name: Apply dependency and policy fixes
        run: |
          cargo update --manifest-path rust/iscy-backend/Cargo.toml -p rustls-webpki --precise 0.103.13
          cargo update --manifest-path rust/iscy-backend/Cargo.toml -p quinn-proto --precise 0.11.15

          python - <<'PY'
          from pathlib import Path

          ci = Path('.github/workflows/ci.yml')
          text = ci.read_text()
          old = '''      - name: Install Rust supply-chain tools
        run: |
          cargo install cargo-audit --locked
          cargo install cargo-deny --locked
'''
          new = '''      - name: Install verified Rust supply-chain tools
        uses: taiki-e/install-action@v2
        with:
          tool: cargo-audit,cargo-deny
          fallback: none
'''
          if old not in text:
              raise SystemExit('expected CI install block not found')
          text = text.replace(old, new)
          text = text.replace(
              'cargo audit --file rust/iscy-backend/Cargo.lock',
              'cargo audit --file rust/iscy-backend/Cargo.lock --ignore RUSTSEC-2023-0071',
          )
          ci.write_text(text)

          deny = Path('deny.toml')
          text = deny.read_text()
          old = 'ignore = []'
          new = '''ignore = [
  { id = "RUSTSEC-2023-0071", reason = "rsa is locked only through disabled sqlx-mysql optional features; cargo tree --target all confirms no reachable ISCY dependency path" },
]'''
          if old not in text:
              raise SystemExit('expected cargo-deny advisory ignore block not found')
          deny.write_text(text.replace(old, new))

          agents = Path('AGENTS.md')
          text = agents.read_text()
          text = text.replace(
              'cargo audit --file rust/iscy-backend/Cargo.lock',
              'cargo audit --file rust/iscy-backend/Cargo.lock --ignore RUSTSEC-2023-0071',
          )
          agents.write_text(text)
          PY

          cargo audit --file rust/iscy-backend/Cargo.lock --ignore RUSTSEC-2023-0071
          cargo deny --manifest-path rust/iscy-backend/Cargo.toml check advisories licenses sources

          rm -f \
            .github/workflows/audit-diagnostic.yml \
            .github/workflows/update-rustsec-lock.yml \
            .github/workflows/update-supply-chain-installer.yml \
            .github/workflows/apply-rustsec-fixes.yml

      - name: Commit reviewed fixes
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git add -A
          git commit -m "Resolve RustSec findings and enforce supply-chain policy"
          git push origin HEAD:${{ github.head_ref }}