From c76cb0dbffa5e2f1371afdef1bffbc93f600c121 Mon Sep 17 00:00:00 2001 From: forkwright Date: Wed, 26 Aug 2026 10:48:01 -0500 Subject: [PATCH] feat(security): let a caller pass cargo-deny arguments Fourteen repos carry a private security.yml instead of calling this reusable -- the largest single drift class in the fleet. Most of it is stale copy-drift, but one difference could not be expressed here at all: four repos (akroasis, epitelesis, logismos, politeia) pass `--all-features` to cargo-deny, and this workflow passed only `command:`. Adopting the reusable would therefore have silently narrowed those four repos' dependency scan to default-features-only resolution. A security check that quietly covers less than it used to is the worst direction for one to move in, and nothing would have reported it. Absent this input the only choices were to keep four private copies or to regress them without noticing. Default is empty, which is cargo-deny's own behaviour and exactly what every current caller gets today, so no existing consumer changes. Verified rather than taken on report: an analysis pass claimed 13 of 14 repos passed --all-features. Reading the `arguments:` key in all fourteen files shows 4. The other nine mention the flag elsewhere in the file, against a different tool. The gap is real and narrower than reported. --- .github/workflows/security.yml | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 827f644..987aa5c 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -36,6 +36,20 @@ on: type: string default: "Cargo.lock" required: false + cargo_deny_arguments: + description: >- + Extra arguments passed to cargo-deny, e.g. "--all-features". Default empty, + which is cargo-deny's own default-features-only resolution. + + WHY this exists: four repos (akroasis, epitelesis, logismos, politeia) pass + --all-features in their local security.yml, and this reusable could not express + it. Adopting the reusable would have silently narrowed their dependency scan to + default features -- a security check that quietly covers less than it did, which + is the worst direction for one to move in. Absent the input, the only options + were to keep four private copies or to regress them without noticing. + type: string + default: "" + required: false secrets: FLEET_REPO_TOKEN: required: false @@ -73,6 +87,7 @@ jobs: - uses: EmbarkStudios/cargo-deny-action@3c6349835b2b7b196a839186cb8b78e02f7b5f25 # v2.1.1 with: command: check advisories licenses bans sources + arguments: ${{ inputs.cargo_deny_arguments }} credentials: ${{ inputs.has_private_deps && format('https://forkwright:{0}@github.com', secrets.FLEET_REPO_TOKEN) || '' }} use-git-cli: ${{ inputs.has_private_deps }}