bitcoindevkit / rust-esplora-client / 32077286531
87%

DEFAULT BRANCH: master
Ran
Jobs 1
Files 10
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 87.372%. Remained the same
32077286531

push

github

luisschwab 
Merge bitcoindevkit/rust-esplora-client#242: ci: audit all lockfiles and bump cargo-rbmt to v0.5.3

de476a77e chore(rust): bump toolchains (Luis Schwab)
7bd81c5e4 fix(deps): patch all RUSTSEC warnings and vulnerabilities (Luis Schwab)
8832f3688 chore: bump electrsd to v0.41.0 (Rishit Modi)
60152d86d ci: bump cargo-rbmt to v0.5.3 (Rishit Modi)
da5cfd529 ci: audit all lockfiles (Rishit Modi)

Pull request description:

  ## Description

  Closes #228
  Closes #227

  Updates the nightly audit workflow to check all three dependency resolutions used by the repository:

  - A freshly updated `Cargo.lock`
  - The committed `Cargo-recent.lock`
  - The committed `Cargo-minimal.lock`

  The audit jobs run sequentially to avoid multiple matrix jobs trying to create or update the same RustSec advisory issue simultaneously.

  Also bumps `cargo-rbmt` to v0.5.3, updates the affected rbmt command syntax, installs the tools declared in `Cargo.toml`, pins `cargo-audit` to v0.22.2, and bumps Zizmor to v1.29.0.

  The local `just audit` recipe now mirrors CI by auditing all three lockfiles.

  ## Notes to the reviewers

  - `Cargo.lock` remains uncommitted and is freshly updated before auditing. The recent and minimal resolutions continue to use the committed rbmt lockfiles.

  - The audit matrix uses `max-parallel: 1` so `rustsec/audit-check` jobs do not race while reporting the same advisory through GitHub Checks or issues.

  - `cargo audit` flagged vulnerable versions of `bzip2`, `mio`, and `ring` in `Cargo-minimal.lock`, so minimum safe development dependency constraints were added to prevent those versions from being selected.

  - The rbmt v0.5.3 migration includes:
    - `cargo rbmt docsrs` → `cargo rbmt docs`
    - `--lock-file` → `--lockfile`
    - Installing declared tools with `cargo rbmt tools`

  - `ele... (continued)

1536 of 1758 relevant lines covered (87.37%)

24.13 hits per line

Jobs
ID Job ID Ran Files Coverage
1 32077286531.1 10
87.37
 GitHub Action Run
Source Files on build 32077286531