Security #39

	name: Security

	on:
	push:
	branches: [main]
	schedule:
	- cron: '0 6 * * 1'

	jobs:
	audit:
	name: Cargo Audit
	runs-on: ubuntu-latest
	permissions:
	checks: write
	contents: read
	steps:
	- uses: actions/checkout@v4
	- uses: rustsec/audit-check@v2
	with:
	token: ${{ secrets.GITHUB_TOKEN }}
	# RUSTSEC-2023-0071: rsa Marvin Attack timing sidechannel.
	# No fix available. Enters via sqlx-macros-core -> sqlx-mysql which
	# sqlx's proc-macro crate pulls unconditionally regardless of features.
	# Forge never performs RSA operations; rsa is never invoked at runtime.
	# Revisit when sqlx gates sqlx-mysql behind a feature flag.
	#
	# RUSTSEC-2026-0097: rand unsoundness via custom logger + rand::rng().
	# No patched version exists for rand 0.8.x or 0.9.x. rand is a purely
	# transitive dependency; Forge defines no custom logger that accesses
	# rand::rng(), so the unsoundness preconditions are not met.
	# Remove when a patched rand version is released.
	ignore: RUSTSEC-2023-0071,RUSTSEC-2026-0097

	codeql:
	name: CodeQL
	runs-on: ubuntu-latest
	permissions:
	security-events: write
	steps:
	- uses: actions/checkout@v4
	- uses: github/codeql-action/init@v3
	with:
	languages: rust
	- uses: github/codeql-action/autobuild@v3
	- uses: github/codeql-action/analyze@v3

Navigation Menu