Skip to content

Commit 2bf139a

Browse files
committed
Don't fail CI cargo deny advisories via gix-testtools
The `gix-testtools` crate depends on previous major/breaking versions of some `gix-*` crates, as described in GitoxideLabs#1510 (comment) and further discussed in GitoxideLabs#1886. This creates a situation where `gix-testtools` will sometimes use `gix-*` crates in vulnerable versions. Even as `gix-testtools` is used in this project, that could in principle cause a problem for some vulnerabilities. So it is correct in general to consider vulnerable `gix-testtools` dependencies significant. However, in most vulnerabilities so far, the specific use in `gix-testtools` as part of gitoxide's test suite has been acceptable. (Other common uses of `gix-testtools`, if they are in test suites operating on trusted data as here, may be in a similar situation, but it may not be reasonable to assume that broadly.) When `cargo deny advisories` fails on CI due to a `gix-testtools` dependency on an old version of a `gix-*` crate, it makes it harder to notice if *other* vulnerable dependencies are also being used. A usual workaround for this would be to add the vulnerability's RUSTSEC ID to the `ignore` list in `deny.toml`, but that would weaken the operation of `cargo deny` far too much, because: - The distraction here is mainly, or perhaps only, a problem in CI, so no change to `deny.toml` may be needed. - It should remain easy to run `cargo deny` in such a way that the dependence of `gix-testtools` on vulnerable crate versions is revealed, and it should be obvious from the command that is run whether that information would be shown or not. - The advisories themselves should not be ignored because they are unexpected, and potentially highly consequently, if they arise from any other crate. - It is useful to be able to easily compare the output of `cargo deny advisories` with and without such messages. So this multiplies the step into two, running `cargo deny` twice for advisories: 1. Initially including dependencies through `gix-testtools`, but marking the step as `continue-on-error: true` so it doesn't fail the job. 2. Again without dependencies through `gix-testtools`, allowing the step to fail the job on vulnerabilities found via other crates.
1 parent 420e730 commit 2bf139a

File tree

1 file changed

+9
-1
lines changed

1 file changed

+9
-1
lines changed

.github/workflows/ci.yml

+9-1
Original file line numberDiff line numberDiff line change
@@ -342,8 +342,16 @@ jobs:
342342

343343
steps:
344344
- uses: actions/checkout@v4
345-
- uses: EmbarkStudios/cargo-deny-action@v2
345+
- name: Check all packages
346+
uses: EmbarkStudios/cargo-deny-action@v2
347+
with:
348+
arguments: --all-features
349+
command: check advisories
350+
continue-on-error: true
351+
- name: Check all packages except gix-testtools
352+
uses: EmbarkStudios/cargo-deny-action@v2
346353
with:
354+
arguments: --exclude gix-testtools --all-features
347355
command: check advisories
348356

349357
cargo-deny:

0 commit comments

Comments
 (0)