From 2b17b433b3569235493ab61b3516385865afe760 Mon Sep 17 00:00:00 2001 From: ajaysehwal Date: Sun, 18 Oct 2026 21:28:09 +0530 Subject: [PATCH] Generate `Cargo.lock` before running the security audit Since we bumped `rustsec/audit-check` to `v2` in b3fe392, the action no longer generates a lockfile itself. As we don't commit `Cargo.lock`, every scheduled audit run since 2026-04-09 failed with `Couldn't load ./Cargo.lock`, meaning we haven't been notified about any new RUSTSEC advisories since. Here, we fix this by generating the lockfile in a dedicated step before running the audit. This change was prepared with the assistance of AI tools (Claude Code). --- .github/workflows/audit.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml index 8d01b77e38..bc33a75a53 100644 --- a/.github/workflows/audit.yml +++ b/.github/workflows/audit.yml @@ -21,6 +21,8 @@ jobs: steps: - name: Checkout source code uses: actions/checkout@v6 + - name: Generate Cargo.lock + run: cargo generate-lockfile - name: Run security audit uses: rustsec/audit-check@v2 with: