From 6943412b48acd320b02c0d5d0046f6e98f86f25e Mon Sep 17 00:00:00 2001 From: Jonas Bushart Date: Fri, 19 Jan 2024 23:28:36 +0100 Subject: [PATCH 1/3] Add some debug logging for cargo audit --- audit.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/audit.py b/audit.py index 8363ee1..31dfd32 100644 --- a/audit.py +++ b/audit.py @@ -410,7 +410,9 @@ def run() -> None: text=True, check=False, ) + debug(f"Command return code: {completed.returncode}") debug(f"Command output: {completed.stdout}") + debug(f"Command error: {completed.stderr}") data = json.loads(completed.stdout) summary = create_summary(data) From 96eb2dcbe4cd421013649b499e13cd1c1c873bac Mon Sep 17 00:00:00 2001 From: Jonas Bushart Date: Fri, 19 Jan 2024 23:59:25 +0100 Subject: [PATCH 2/3] Generate lockfile when not existing Whenever the `file` argument is set give, then cargo audit will not generate the file if it doesn't exist --- README.md | 2 +- action.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index bd3f7f7..86d8098 100644 --- a/README.md +++ b/README.md @@ -53,7 +53,7 @@ Setting `denyWarnings` to true will also enable these warnings, but each warning | -------------- | ------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------ | | `TOKEN` | The GitHub access token to allow us to retrieve, create and update issues (automatically set). | `github.token` | | `denyWarnings` | Any warnings generated will be treated as an error and fail the action. | false | -| `file` | The path to the Cargo.lock file. | `Cargo.lock` | +| `file` | The path to the Cargo.lock file. | | | `ignore` | A comma separated list of Rustsec IDs to ignore. | | | `createIssues` | Create/Update issues for each found vulnerability. By default only on `main` or `master` branch. | `github.ref == 'refs/heads/master' \|\| github.ref == 'refs/heads/main'` | diff --git a/action.yml b/action.yml index b61508e..efddd43 100644 --- a/action.yml +++ b/action.yml @@ -17,7 +17,7 @@ inputs: file: description: "Cargo lockfile to inspect" required: false - default: "Cargo.lock" + default: "" ignore: description: "A comma separated list of Rustsec IDs to ignore" required: false From 959eb6cc5c9720f2e75c04d787e47c53f9187119 Mon Sep 17 00:00:00 2001 From: Jonas Bushart Date: Sat, 20 Jan 2024 00:23:38 +0100 Subject: [PATCH 3/3] Update changelog --- CHANGELOG.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 94920c7..2cfe3d6 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +## [1.1.12] - 2024-01-20 + +* Fix default of `file` argument to make it work again for repositories without `Cargo.lock` checked in. + ## [1.1.11] - 2024-01-18 * Allow specifying the path to the `Cargo.lock` file, in case it is not in the root of the repository (#55)