fix: clear dependency security advisories

2026-07-10 18:59:03 +08:00
parent d730e51c3d
commit e049cb6880
11 changed files with 242 additions and 41 deletions
@@ -37,6 +37,12 @@ jobs:
          restore-keys: |
            cargo-${{ runner.os }}-

+      - name: Install cargo-audit 0.22.2
+        run: cargo install cargo-audit --version 0.22.2 --locked
+
+      - name: Audit Rust vulnerabilities and unsoundness
+        run: cargo audit --deny unsound
+
      # Fonts for typst compilation (WU-4 onward): the engineering files are
      # CJK-heavy, so the compile-check / build tests need a CJK font present.
      # Harmless before those crates exist.
@@ -43,6 +43,9 @@ jobs:
      - name: Install dependencies
        run: npm ci

+      - name: Audit production Node dependencies
+        run: npm run audit:production
+
      - name: Install Linux sandbox dependency
        run: sudo apt-get update && sudo apt-get install --yes bubblewrap socat