deps(cargo)(deps): bump toml from 0.8.23 to 1.1.3+spec-1.1.0 #762
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # CI gate macro: CI gate covering the full quality bar: | |
| # build / test / clippy-deny / fmt / supply-chain audit. | |
| # | |
| # `cargo audit` runs against `Cargo.lock` and fails if any direct or | |
| # transitive dependency has a CVE in the RustSec advisory database. | |
| # That gives us a formal supply-chain check at every push and PR; | |
| # `Cargo.lock` is committed so the audit is reproducible. | |
| # | |
| # All third-party actions are pinned to a 40-char commit SHA, not a | |
| # floating tag. `@v4` would let an attacker who compromises the action | |
| # repo (or the publisher's npm/PAT) silently re-tag a malicious commit | |
| # and reach our workflow's GITHUB_TOKEN — the tj-actions/changed-files | |
| # class of supply-chain attack. The `# vX.Y.Z` trailing comment records | |
| # what the SHA was when pinned so reviewers don't have to look it up; | |
| # Dependabot updates both the SHA and the comment together | |
| # (see `.github/dependabot.yml` — github-actions ecosystem). | |
| name: CI | |
| on: | |
| push: | |
| branches: [main, master] | |
| pull_request: | |
| branches: [main, master] | |
| schedule: | |
| # Daily 04:17 UTC sweep — catches CVEs disclosed AFTER the last | |
| # commit. The commit-triggered runs above only see CVEs known at | |
| # commit time. | |
| - cron: "17 4 * * *" | |
| # Minimal top-level permissions — satisfy OpenSSF Scorecard TokenPermissions. | |
| # Individual jobs that need write access declare it explicitly below. | |
| permissions: | |
| contents: read | |
| env: | |
| CARGO_TERM_COLOR: always | |
| RUST_BACKTRACE: 1 | |
| # Cancel superseded runs on the same ref (rapid pushes to a PR) so we don't | |
| # burn runners on stale commits or race the required-check status. | |
| concurrency: | |
| group: ci-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| build-test: | |
| name: Build · test · clippy · fmt | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Install Rust toolchain (stable) | |
| uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable (HEAD as of 2026-03-27) | |
| with: | |
| components: rustfmt, clippy | |
| - name: Cache cargo registry + target | |
| uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 | |
| - name: Format check | |
| run: cargo fmt --all -- --check | |
| - name: Clippy (deny tier) | |
| # The `[lints.clippy]` block in Cargo.toml already declares | |
| # `unwrap_used`, `expect_used`, `panic`, `todo` as deny. We | |
| # also surface pedantic/nursery as warnings (informational). | |
| # `--all-targets` covers tests + examples + benches. | |
| run: cargo clippy --all-targets | |
| - name: Build (debug) | |
| run: cargo build --all-targets | |
| - name: Test | |
| run: cargo test --all-targets | |
| - name: Build (release, stripped) | |
| run: cargo build --release | |
| audit: | |
| name: Supply-chain audit | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Install Rust toolchain (stable) | |
| uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable (HEAD as of 2026-03-27) | |
| - name: Cache cargo registry | |
| uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 | |
| with: | |
| # Don't share with build-test cache — we only need the | |
| # registry, not target/. | |
| shared-key: audit | |
| - name: Install cargo-audit | |
| run: cargo install --locked cargo-audit | |
| - name: Audit Cargo.lock for CVEs | |
| # The `--deny warnings` flag escalates yanked-crate notices | |
| # into hard failures alongside actual CVEs. Adjust if it | |
| # becomes too noisy for legitimate reasons (then keep just | |
| # `cargo audit`). | |
| run: cargo audit --deny warnings | |
| deny: | |
| name: Supply-chain policy (cargo-deny) | |
| runs-on: ubuntu-latest | |
| # Companion to `audit:` above. `cargo audit` covers CVE advisories | |
| # against the RustSec DB; `cargo deny` additionally enforces: | |
| # - License whitelist (MIT/Apache-2.0/BSD/ISC/MPL-2.0 + curated | |
| # exceptions). Blocks GPL / AGPL / SSPL transitively. | |
| # - Banned crates (openssl / native-tls — rustls-only posture). | |
| # - Source locking (crates.io only — no git deps). | |
| # - Wildcard-version detection (refuses `version = "*"`). | |
| # - Multiple-major-version drift (warn-only). | |
| # | |
| # Config lives in `deny.toml` at repo root; every ignore/exception | |
| # is documented with the dep path + why-accepted + remediation. | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Install Rust toolchain (stable) | |
| uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable (HEAD as of 2026-03-27) | |
| - name: Cache cargo registry | |
| uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 | |
| with: | |
| shared-key: deny | |
| - name: Install cargo-deny | |
| run: cargo install --locked cargo-deny | |
| - name: Check supply-chain policy (advisories + licenses + bans + sources) | |
| run: cargo deny check | |
| musl-static: | |
| name: Static binary (musl) | |
| runs-on: ubuntu-latest | |
| # Macro audit: `x86_64-unknown-linux-musl` produces | |
| # a TRULY portable Linux binary that links libc statically. The | |
| # default `x86_64-unknown-linux-gnu` glibc binary built on Ubuntu | |
| # 24.04 (`GLIBC_2.39`) crashes on Debian 11 (`GLIBC_2.31`) / | |
| # Alpine (musl) with `symbol lookup error`. The musl artefact | |
| # runs on every Linux distro from RHEL 6 to Alpine 3.20. | |
| # | |
| # We don't run tests on musl — the library code is identical, the | |
| # only delta is the link target. | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Install Rust toolchain + musl target | |
| uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable (HEAD as of 2026-03-27) | |
| with: | |
| targets: x86_64-unknown-linux-musl | |
| - name: Install musl-tools | |
| run: sudo apt-get update && sudo apt-get install -y musl-tools | |
| - name: Cache cargo registry + target | |
| uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 | |
| with: | |
| shared-key: musl | |
| - name: Build static release | |
| run: cargo build --release --target x86_64-unknown-linux-musl | |
| - name: Verify the binary is statically linked | |
| # `ldd` on a static binary prints "not a dynamic executable" | |
| # OR "statically linked" depending on libc; either is the | |
| # correct outcome — we fail only if it lists shared deps. | |
| run: | | |
| set -e | |
| BIN=target/x86_64-unknown-linux-musl/release/proxxx | |
| file "$BIN" | |
| if ldd "$BIN" 2>&1 | grep -q "=>"; then | |
| echo "ERROR: musl binary still has dynamic deps" | |
| ldd "$BIN" | |
| exit 1 | |
| fi | |
| echo "OK: $BIN is statically linked" | |
| - name: Upload artifact | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: proxxx-x86_64-linux-musl | |
| path: target/x86_64-unknown-linux-musl/release/proxxx | |
| retention-days: 14 |