mirror of
https://github.com/nushell/nushell
synced 2024-12-26 13:03:07 +00:00
27dcc3ecc3
<!-- if this PR closes one or more issues, you can automatically link the PR with them by using one of the [*linking keywords*](https://docs.github.com/en/issues/tracking-your-work-with-issues/linking-a-pull-request-to-an-issue#linking-a-pull-request-to-an-issue-using-a-keyword), e.g. - this PR should close #xxxx - fixes #xxxx you can also mention related issues, PRs or discussions! --> # Description `chrono` crate enables `oldtime` feature by default, which has a vulnerability (https://rustsec.org/advisories/RUSTSEC-2020-0071). This PR tries to remove `time` v0.1.45 completely from nu and add an audit CI to check for security vulnerabilities. ✋ Wait for the following PRs: - [x] https://github.com/nushell/reedline/pull/599 - [x] https://github.com/bspeice/dtparse/pull/44 - [x] https://github.com/Byron/trash-rs/pull/75 - [x] https://gitlab.com/imp/chrono-humanize-rs/-/merge_requests/15 # User-Facing Changes <!-- List of all changes that impact the user experience here. This helps us keep track of breaking changes. --> # Tests + Formatting <!-- Don't forget to add tests that cover your changes. Make sure you've run and fixed any issues with these commands: - `cargo fmt --all -- --check` to check standard code formatting (`cargo fmt --all` applies these changes) - `cargo clippy --workspace -- -D warnings -D clippy::unwrap_used -A clippy::needless_collect -A clippy::result_large_err` to check that you're using the standard code style - `cargo test --workspace` to check that all tests pass - `cargo run -- crates/nu-std/tests/run.nu` to run the tests for the standard library > **Note** > from `nushell` you can also use the `toolkit` as follows > ```bash > use toolkit.nu # or use an `env_change` hook to activate it automatically > toolkit check pr > ``` --> # After Submitting <!-- If your PR had any user-facing changes, update [the documentation](https://github.com/nushell/nushell.github.io) after the PR is merged, if necessary. This will help us keep the docs up to date. --> --------- Co-authored-by: sholderbach <sholderbach@users.noreply.github.com>
25 lines
494 B
YAML
25 lines
494 B
YAML
name: Security audit
|
|
on:
|
|
pull_request:
|
|
paths:
|
|
- '**/Cargo.toml'
|
|
- '**/Cargo.lock'
|
|
push:
|
|
branches:
|
|
- main
|
|
|
|
env:
|
|
RUST_BACKTRACE: 1
|
|
CARGO_TERM_COLOR: always
|
|
CLICOLOR: 1
|
|
|
|
jobs:
|
|
security_audit:
|
|
runs-on: ubuntu-latest
|
|
# Prevent sudden announcement of a new advisory from failing ci:
|
|
continue-on-error: true
|
|
steps:
|
|
- uses: actions/checkout@v3
|
|
- uses: rustsec/audit-check@v1.4.1
|
|
with:
|
|
token: ${{ secrets.GITHUB_TOKEN }}
|