actions-rs / audit-check

🛡️ GitHub Action for security audits
https://github.com/marketplace/actions/rust-audit-check
MIT License
170 stars 39 forks source link

Include `cargo tree -i <crate>` output in issue #126

Open Nemo157 opened 4 years ago

Nemo157 commented 4 years ago

Motivation

First step of triaging an audit issue is to see why the affected crate is being included in the build, to see if it's a direct dependency that can be controlled, or a deep dependency that may need more effort. Including the output from cargo tree -i <crate> in the opened issue would allow trivially seeing this from the issue directly (example).

svartalf commented 4 years ago

Hi, @Nemo157! I agree that adding it would be very helpful; I'm aiming to get this information from cargo-audit directly, see https://github.com/RustSec/cargo-audit/issues/227#issuecomment-630091843