Open moliva opened 2 years ago
This would be a blast!
There are several use cases where we'd like to ignore some smaller reported issues.
An example is the chrono
package which has a segmentation fault issue for a specific Linux distribution. But chrono is used in many packages as dependency and is not yet updated.
Would it be possible to support the ignore syntax mentioned in https://github.com/actions-rs/audit-check/issues/223?
Would it be possible to support the ignore syntax mentioned in #223?
The original implementation used this array/list format, but it seems GitHub Actions input doesn't support anything but strings (at least up to this point in time).
Hi @svartalf -- any chance you could take a look at this PR?
@moliva I think you need to add the new input to https://github.com/actions-rs/audit-check/blob/master/action.yml#L8 as well
Looks like this should probably work
inputs:
token:
description: GitHub Actions token
required: true
ignore:
description: Comma-separated list of advisory ids to ignore
required: false
This would be really useful re: https://github.com/actions-rs/audit-check/issues/223 - any thing blocking this from getting merged?
This repo seems pretty quiet. You all are welcome to depend on https://github.com/GothenburgBitFactory/audit-check in the interim, or of course you can fork the action yourself.
@matschaffer thanks - I can add that on the fork.
Thanks @djmitche - seems to work a treat! https://github.com/matschaffer/zero2prod/runs/7492523985?check_suite_focus=true
@moliva I think you need to add the new input to https://github.com/actions-rs/audit-check/blob/master/action.yml#L8 as well
Looks like this should probably work
inputs: token: description: GitHub Actions token required: true ignore: description: Comma-separated list of advisory ids to ignore required: false
Thanks @matschaffer , I wasn't aware of that file. This PR by itself is already working for me, I've been using it mostly because of chrono's potential issues, see here.
So it turns out that .cargo/audit.toml
can be used to ignore things, too -- I just had it in the wrong directory (fix in https://github.com/GothenburgBitFactory/taskwarrior/pull/2903). So the fork probably isn't necessary!
Ooooh! nice find!
There were a lot of outdated dependencies which have been brought relatively up to date at:
We've forked to rustsec/audit-check
Have also forked actions-rs/core to rinse-repeat/audit-rs-core
cargo audit --ignore
.nvrm
to Node v16 to avoid issue with envelope routines unsupportedUsage example:
This version can be used FTTB with this option installed:
moliva/audit-check@v1.3.2
.