From 951109d55c3b5d41c330a4a8bb35b4e5c63a1b4d Mon Sep 17 00:00:00 2001 From: Albert Hui Date: Fri, 7 Aug 2026 09:16:59 -0700 Subject: [PATCH] ci: repin fleet-ci so this repo's own deny.toml is used again MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The shared workflow's `deny-config-repo` input defaulted to SecurityRonin/fleet-config, so adopting it silently replaced this repo's supply-chain policy with the shared one. That is a real change to what `cargo deny` accepts, and no adoption PR disclosed it — nobody involved knew. Measured across the fleet when it was found: 61 of 65 adopted repos had a stricter local config. The shared one carries 21 advisory ignores against their `ignore = []`, every one a bare RUSTSEC id with no reason and no removal condition — which the fleet's own suppression rule forbids. Among them RUSTSEC-2023-0071 (rsa, Marvin timing attack). Several repos also went from `bans.multiple-versions = "deny"` to `"warn"` and gained nine allowed licences. fleet-ci now defaults to the repository's own deny.toml; opting into the shared config is explicit. This repin picks that up, restoring the policy this repo actually wrote. Reassuring rather than alarming: before this fix all 65 adopted repos were re-checked against their OWN deny.toml and all 65 passed. The gate was weakened, but nothing was hiding behind it. If this repin does turn a check red, that is a true finding this repo's own policy always meant to catch — fix it rather than re-pointing at the shared config. Only the pinned SHA changes. --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 7645891..3c61f0f 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -18,4 +18,4 @@ jobs: # and MSRV is read from rust-version. Anything that needed configuring would be # a behaviour change smuggled in by an adoption PR, so there is nothing here. ci: - uses: SecurityRonin/fleet-ci/.github/workflows/rust-ci.yml@a62ab10603151071744cec0b4e3638aa6406d4e4 + uses: SecurityRonin/fleet-ci/.github/workflows/rust-ci.yml@f9802dca64a95eb881fd05dd3f4f16e53b97f2b3