From 1b39b2b6f2b9b74018fa9463df311527ae99699e Mon Sep 17 00:00:00 2001
From: Mathieu Piton <27002047+mpiton@users.noreply.github.com>
Date: Sun, 19 Jul 2026 15:01:04 +0200
Subject: [PATCH 1/2] chore(ci): ignore quick-xml advisories in cargo audit
 config

RUSTSEC-2026-0194/0195 fire on quick-xml 0.39.4, reachable only through
the wayland-scanner build-time proc-macro (trusted protocol XML, never in
the shipped binary). The bump to quick-xml 0.41 is merged upstream
(Smithay/wayland-rs d07c4f91f2) but not released, so cargo update can't
purge it yet. Mirror the existing deny.toml triage in .cargo/audit.toml
so local cargo audit runs stay actionable. Remove both entries once
wayland-scanner > 0.31.10 ships.

Refs MAT-139
---
 .cargo/audit.toml | 7 +++++++
 CHANGELOG.md      | 8 ++++++++
 2 files changed, 15 insertions(+)

diff --git a/.cargo/audit.toml b/.cargo/audit.toml
index 025ae578..c94cc6a8 100644
--- a/.cargo/audit.toml
+++ b/.cargo/audit.toml
@@ -22,4 +22,11 @@ ignore = [
     "RUSTSEC-2026-0094",
     "RUSTSEC-2026-0095",
     "RUSTSEC-2026-0096",
+    # quick-xml 0.39.4 via wayland-scanner 0.31.10 (build-time proc-macro,
+    # trusted protocol XML — not reachable at runtime). Fix merged upstream
+    # (Smithay/wayland-rs d07c4f91f2, quick-xml 0.41) but not released yet.
+    # Temporary: remove after `cargo update` once wayland-scanner > 0.31.10
+    # ships. Tracking: MAT-139. Review by 2026-10-15 (aligned with deny.toml).
+    "RUSTSEC-2026-0194",
+    "RUSTSEC-2026-0195",
 ]
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8da04b5b..12d5cc38 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Security
+
+- `cargo audit` config now ignores RUSTSEC-2026-0194/0195 (quick-xml 0.39.4
+  via the `wayland-scanner` build-time proc-macro) with a documented review
+  date, matching the existing `deny.toml` triage. The fix is merged upstream
+  but unreleased; the ignore goes away once wayland-scanner > 0.31.10 ships
+  (MAT-139).
+
 ### Changed
 
 - CI/release workflows: bumped all actions still targeting Node.js 20 to

From d87e581cd2b077192df3049b42b3581a5115b6a7 Mon Sep 17 00:00:00 2001
From: Mathieu Piton <27002047+mpiton@users.noreply.github.com>
Date: Sun, 19 Jul 2026 15:34:30 +0200
Subject: [PATCH 2/2] fix(ci): supply both first-interaction messages in one
 welcome job

actions/first-interaction v3 reads issue_message and pr_message with
required: true at runtime even though action.yml declares neither as
required. The split welcome-pr/welcome-issue jobs each passed only one
message, so every first-time PR (and, next time, issue) crashed with
'Input required and not supplied'. Merge them into a single job that
handles both events and supplies both messages.
---
 .github/workflows/contributor.yml | 21 +++++++--------------
 CHANGELOG.md                      |  7 +++++++
 2 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/.github/workflows/contributor.yml b/.github/workflows/contributor.yml
index 12d36cf0..f308aab5 100644
--- a/.github/workflows/contributor.yml
+++ b/.github/workflows/contributor.yml
@@ -19,11 +19,15 @@ jobs:
     steps:
       - uses: actions/labeler@b8dd2d9be0f68b860e7dae5dae7d772984eacd6d # v6.2.0
 
-  welcome-pr:
-    name: Welcome New Contributors (PR)
-    if: github.event_name == 'pull_request' && github.event.action == 'opened'
+  welcome:
+    name: Welcome New Contributors
+    # first-interaction v3 requires both issue_message and pr_message at
+    # runtime (even though action.yml marks neither as required), so a single
+    # job handles both events with both messages supplied.
+    if: github.event.action == 'opened' && (github.event_name == 'pull_request' || github.event_name == 'issues')
     runs-on: ubuntu-latest
     permissions:
+      issues: write
       pull-requests: write
     steps:
       - uses: actions/first-interaction@1c4688942c71f71d4f5502a26ea67c331730fa4d # v3.1.0
@@ -36,17 +40,6 @@ jobs:
             - [ ] `npx oxlint .` passes
             - [ ] All tests pass (`cargo test` and `npx vitest run`)
             - [ ] `CHANGELOG.md` updated under `[Unreleased]`
-
-  welcome-issue:
-    name: Welcome New Contributors (Issue)
-    if: github.event_name == 'issues' && github.event.action == 'opened'
-    runs-on: ubuntu-latest
-    permissions:
-      issues: write
-    steps:
-      - uses: actions/first-interaction@1c4688942c71f71d4f5502a26ea67c331730fa4d # v3.1.0
-        with:
-          repo_token: ${{ secrets.GITHUB_TOKEN }}
           issue_message: |
             Thanks for opening your first issue! We'll take a look as soon as possible. In the meantime, please make sure you've provided enough context for us to reproduce or understand the problem.
 
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 12d5cc38..7892a71f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -15,6 +15,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   but unreleased; the ignore goes away once wayland-scanner > 0.31.10 ships
   (MAT-139).
 
+### Fixed
+
+- Contributor Automation: `actions/first-interaction` v3 requires both
+  `issue_message` and `pr_message` at runtime, so the split welcome jobs
+  each crashed with "Input required and not supplied". Merged them into a
+  single job that supplies both messages.
+
 ### Changed
 
 - CI/release workflows: bumped all actions still targeting Node.js 20 to