ci: scan dependencies weekly - #9
Conversation
6ef65d9 to
86d350f
Compare
yuval-block
changed the title
dfdab6c to
f7555f5
Compare
d448aab to
c228628
Compare
c228628 to
abb31de
Compare
| name: Vulnerability scan | ||
| on: | ||
| schedule: | ||
| - cron: "0 0 * * *" |
There was a problem hiding this comment.
CACK code looks good ran nix build '.#checks.x86_64-linux.cargo-audit' no error outputs was shown.
The PR description says this scan should run weekly but 0 0 * * * runs every day.
A comment will also help readabilty
| - cron: "0 0 * * *" | |
| schedule: | |
| # Run weekly on Sunday at 00:00 UTC. | |
| - cron: "0 0 * * 0" |
|
Also tested cron job on my branch https://github.com/Mshehu5/concurrent-psbt/actions/runs/30013622141/job/89227795093 ran out off cache though but scan nix closures seems to have caught some packages edit : seems some might also be false positives and not comfirmed edit 2: after running locally this what I got |
| - uses: DeterminateSystems/nix-installer-action@main | ||
| - uses: DeterminateSystems/magic-nix-cache-action@main | ||
| - name: Update vulnerability databases | ||
| run: nix flake update |
There was a problem hiding this comment.
should this be nix flake update rustsec-advisory-db? a bare update refreshes everything, so vulnix scans the updated closure rather than the pinned one
3 participants
Run a read-only vulnerability scan weekly and on manual dispatch.
Add
cargo-auditas a reproducible flake check backed by a pinned RustSec advisory database. The scheduled job recreates flake inputs for the two targeted tasks, runs that audit, builds the default package, and scans its runtime closure withvulnix.The workflow requires no repository-writing token. Its action references are intentionally left unpinned for the subsequent actions-pinning PR to handle consistently.