ci: add daily scheduled RustSec advisory scan #31

New Issue

MrUnknownDE · 2026-04-05T20:29:01+02:00

MrUnknownDE commented

2026-04-05 20:29:01 +02:00

Originally created by @TriplEight on 3/22/2026

cargo deny check advisories runs daily at 11:17 UTC (offset from Trivy
at 11:08 to spread DB load). This catches new CVEs published against
Cargo dependencies between code pushes, matching the coverage Trivy
provides for container vulnerabilities.

Runs advisories-only so duplicate/license warnings don't obscure newly
published CVEs - the full cargo deny check already runs in build.yml on
every push/PR. Guarded to the upstream repo to avoid fork hammering the
RustSec DB. Supports workflow_dispatch for manual triggering.

*Originally created by @TriplEight on 3/22/2026* cargo deny check advisories runs daily at 11:17 UTC (offset from Trivy at 11:08 to spread DB load). This catches new CVEs published against Cargo dependencies between code pushes, matching the coverage Trivy provides for container vulnerabilities. Runs advisories-only so duplicate/license warnings don't obscure newly published CVEs - the full cargo deny check already runs in build.yml on every push/PR. Guarded to the upstream repo to avoid fork hammering the RustSec DB. Supports workflow_dispatch for manual triggering.

Sign in to join this conversation.

No Label

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/vaultwarden#31