ci(desktop): add sibling cargo-deny step for desktop lockfile (#4251) - #5074
Open
iroiro147 wants to merge 1 commit into
Open
ci(desktop): add sibling cargo-deny step for desktop lockfile (#4251)#5074iroiro147 wants to merge 1 commit into
iroiro147 wants to merge 1 commit into
Conversation
Close the CI hole: the root-workspace cargo-deny check ignores desktop/src-tauri/Cargo.lock (independent workspace), so a desktop-only advisory could silently ride along. Add a sibling step running cargo-deny advisories against desktop/src-tauri/Cargo.toml explicitly (aarch64-apple-darwin target, --exclude-dev), using the repo-root deny.toml as config. The security half of the original fix is now redundant — main's desktop lockfile already pins nostr-relay-pool = 0.44.3 (past RUSTSEC-2026-0224). This commit keeps only the CI gate that prevents future divergence. Supersedes block#4291. Refs block#4251. Signed-off-by: iroiro147 <sarthak.singh@mastersunion.org>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Supersedes #4291 (fork-PR rebase v2).
The original PR bundled two changes: bump
nostr-relay-pool0.44.1 → 0.44.2 in the desktop lockfile, and add acargo-denystep that audits the desktop lockfile in CI.Since that PR was opened,
mainhas bumped the desktop lockfile tonostr-relay-pool = 0.44.3, past the RUSTSEC-2026-0224 floor. The version bump is now redundant — only the CI gate remains load-bearing.This PR carries just the CI step: a sibling
cargo-denyinvocation pointing atdesktop/src-tauri/Cargo.toml(aarch64-apple-darwin target,--exclude-dev), using the repo-rootdeny.tomlas config. The rootcargo-deny checkignoresdesktop/src-tauri/Cargo.lockbecause the desktop workspace is independent — without this, a future desktop-only advisory could silently ride along.Refs #4251.