ref: project

Author: sshaplygin

.cargo/audit.toml

@@ -0,0 +1,32 @@
+# Advisories that cannot be resolved from this repository.
+#
+# Every entry below is reachable only through `ydb 0.10.1`, which pins its own
+# old `reqwest 0.11` (-> rustls 0.21 -> rustls-webpki 0.101) and
+# `jsonwebtoken 7.2` (-> ring 0.16). Nothing in this crate can override those.
+#
+# The fix is upgrading `ydb` (0.17.0 is current). That is a breaking API change:
+# `retry_transaction`, `retry_execute_scheme_query`, `retry_execute_bulk_upsert`,
+# `TransactionOptions` and both topic builders were all reworked, so db.rs,
+# producer.rs and consumer.rs need porting and integration testing first.
+#
+# Remove these entries as part of that upgrade — do not extend the list without
+# recording the same reasoning.
+#
+# Note: ignores are by advisory ID, not by version. rustls-webpki 0.103.x is
+# already updated past these three; the entries exist solely for the 0.101.7
+# copy pulled in by the old reqwest.
+
+[advisories]
+ignore = [
+    # ring 0.16.20 <- jsonwebtoken 7.2.0 <- ydb 0.10.1
+    # AES functions may panic when overflow checking is enabled.
+    "RUSTSEC-2025-0009",
+
+    # rustls-webpki 0.101.7 <- rustls 0.21.12 <- reqwest 0.11.27 <- ydb 0.10.1
+    # Reachable panic parsing certificate revocation lists.
+    "RUSTSEC-2026-0104",
+    # Name constraints for URI names were incorrectly accepted.
+    "RUSTSEC-2026-0098",
+    # Name constraints accepted for certs asserting a wildcard name.
+    "RUSTSEC-2026-0099",
+]

.dockerignore

@@ -1,2 +1,10 @@
 .env
 .HELP.md
+target
+.git
+.github
+.vscode
+.claude
+http
+README.md
+docker-compose.yaml

.github/workflows/ci.yaml

@@ -8,6 +8,10 @@ on:
   pull_request:
     branches:
       - main
+  # Advisories land independently of code changes, so re-run on a schedule to
+  # catch new CVEs in dependencies that are already merged.
+  schedule:
+    - cron: "0 6 * * 1"
 
 jobs:
   fmt:
@@ -41,7 +45,7 @@ jobs:
         uses: Swatinem/rust-cache@v2
 
       - name: Run Clippy
-        run: cargo clippy --all-targets --all-features -- -D warnings
+        run: cargo clippy --all-targets --all-features --locked -- -D warnings
 
   test:
     name: Tests
@@ -57,4 +61,25 @@ jobs:
         uses: Swatinem/rust-cache@v2
 
       - name: Run tests
-        run: cargo test --all-features
+        run: cargo test --all-features --locked
+
+  audit:
+    name: Security audit
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Install cargo-audit
+        uses: taiki-e/install-action@v2
+        with:
+          tool: cargo-audit
+
+      # Fails on any vulnerability except those documented in .cargo/audit.toml.
+      # Unmaintained-crate warnings are reported but do not gate merges, since
+      # every current one is transitive through ydb.
+      - name: Audit dependencies for known vulnerabilities
+        run: cargo audit