TEST VETTING - DO NOT APPROVE by bronzelle-cw · Pull Request #2440 · cloudwalk/stratus

bronzelle-cw · 2026-01-23T21:01:19Z

PR Type

Enhancement

Description

Introduce Dependabot Cargo Vet GitHub Actions workflow
Integrate cargo-vet with Codex agent for audits
Auto-commit audit changes on successful vetting
Bump uuid crate to version 1.19.0

Diagram Walkthrough

flowchart LR
  PR["Pull Request"]
  Checkout["Checkout PR head"]
  Setup["Set up Rust & install cargo-vet"]
  Vet["Run cargo vet --locked"]
  Exit["Exit if fully vetted"]
  Diff["Collect unvetted crate diff"]
  Prompt["Build Codex prompt"]
  Codex["Codex audit action"]
  Apply["Apply agent audits"]
  Commit["Commit audit changes"]

  PR --> Checkout
  Checkout --> Setup
  Setup --> Vet
  Vet -->|vetted| Exit
  Vet -->|unvetted| Diff
  Diff --> Prompt
  Prompt --> Codex
  Codex --> Apply
  Apply --> Commit

File Walkthrough

Relevant files

Configuration changes

dependabot-auto-vet.yml `Add Dependabot Cargo Vet workflow` .github/workflows/dependabot-auto-vet.yml Add new Dependabot Cargo Vet workflow Define steps: checkout, Rust setup, install cargo-vet Run initial vet, import audits, derive vet status Integrate Codex for automated audit and commit	+191/-0

Dependencies

Cargo.toml `Bump uuid crate to 1.19.0` Cargo.toml Bump `uuid` dependency version from 1.18.1 to 1.19.0 Retain `"v7"` feature	+1/-1

github-actions · 2026-01-23T21:02:25Z

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 2 🔵🔵⚪⚪⚪
🧪 No relevant tests
🔒 No security concerns identified
⚡ Recommended focus areas for review Fragile output parsing The shell parsing of `cargo vet` output using `grep` and simple string slicing can break if the output format changes. Consider using `cargo vet --output-format json` and a JSON parser or more robust extraction logic to reliably capture unvetted crate names and versions. run: \| # Expect a single unvetted crate from dependabot PRs; parse the line "crate:old -> new" logfile="vet-locked-final.log" if [ ! -f "$logfile" ]; then logfile="vet-locked.log" fi line="$(grep -m1 'unvetted dependencies:' -A2 "$logfile" \| tail -n1 \| tr -d '[:space:]')" crate="${line%%:}" vers="${line#:}" old="${vers%->}" new="${vers#->}" if [ -z "$crate" ] \|\| [ -z "$old" ] \|\| [ -z "$new" ]; then echo "Failed to parse unvetted crate/version from vet output" >&2 exit 1 fi Incorrect failure handling in GitHub Script The `actions/github-script` step uses `core.setFailed` without importing or referencing the `@actions/core` module. In this context you should throw an error (e.g. `throw new Error(...)`) or ensure the correct API is available. - name: Comment when agent step failed or missing if: steps.vet_status.outputs.status != '0' && (steps.codex.outcome == 'failure' \|\| steps.codex.outputs.response == '') uses: actions/github-script@v7 with: script: \| const crate = '${{ steps.collect_unvetted_and_diff.outputs.crate }}'; const version = '${{ steps.collect_unvetted_and_diff.outputs.version }}'; const msg = [ 'Cargo vet still needs audits and no agent result was applied.', '', `Unvetted dependency: ${crate} ${version}`, '', 'Codex agent was not configured or did not return a response. Ensure OPENAI_API_KEY is set and the prompt is valid.' ].join('\n'); await github.rest.issues.createComment({ owner: context.repo.owner, repo: context.repo.repo, issue_number: context.issue.number, body: msg }); core.setFailed('Agent step failed or was not configured.')

github-actions · 2026-01-23T21:03:39Z

PR Code Suggestions ✨

Explore these optional code suggestions:

Category	Suggestion	Impact
Possible issue	Capture real exit status The current pipeline always records a zero exit code because `\|\| true` resets `$?`. Capture the real exit status before forcing success. .github/workflows/dependabot-auto-vet.yml [38-43] - name: Initial cargo vet --locked id: vet_locked_initial continue-on-error: true run: \| - cargo vet --locked > vet-locked.log 2>&1 \|\| true - echo "status=$?" >> "$GITHUB_OUTPUT" + set +e + cargo vet --locked > vet-locked.log 2>&1 + status=$? + echo "status=$status" >> "$GITHUB_OUTPUT" Suggestion importance[1-10]: 8 __ Why: The `\|\| true` causes `echo` to always report success, so capturing `$?` before forcing success is crucial to detect vet failures.	Medium
General	Sanitize notes for CLI If the `notes` field contains quotes or newlines, the CLI call can break. Normalize newlines to spaces and escape quotes before passing to `--notes`. .github/workflows/dependabot-auto-vet.yml [169] -cargo vet certify "$crate" "$version" --criteria "$criteria" --who "$who" --notes "$notes" --accept-all +safe_notes=$(echo "$notes" \| tr '\n' ' ' \| sed 's/\"/\\"/g') +cargo vet certify "$crate" "$version" --criteria "$criteria" --who "$who" --notes "$safe_notes" --accept-all Suggestion importance[1-10]: 6 __ Why: Normalizing newlines and escaping quotes in `notes` prevents malformed command lines and potential script failures when calling `cargo vet certify`.	Low
General	Enable pushing new commits To allow pushing audit commits back to the PR branch, the checkout action needs the full history. Add `fetch-depth: 0` so Git can create and push new commits. .github/workflows/dependabot-auto-vet.yml [22-26] - name: Checkout PR head uses: actions/checkout@v4 with: ref: ${{ github.event.pull_request.head.sha }} persist-credentials: true + fetch-depth: 0 Suggestion importance[1-10]: 5 __ Why: Adding `fetch-depth: 0` ensures the full Git history is available, which is necessary for creating and pushing audit commits back to the PR.	Low

codecov · 2026-01-23T21:07:35Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 84.32%. Comparing base (c06f544) to head (9a29043).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2440      +/-   ##
==========================================
- Coverage   84.34%   84.32%   -0.02%     
==========================================
  Files         141      141              
  Lines       10803    10803              
==========================================
- Hits         9112     9110       -2     
- Misses       1691     1693       +2

Flag	Coverage Δ
contracts-rocks-asset-transit-desk	`43.64% <ø> (ø)`
contracts-rocks-balance-freezer	`42.71% <ø> (ø)`
contracts-rocks-balance-tracker	`43.06% <ø> (ø)`
contracts-rocks-base	`43.62% <ø> (ø)`
contracts-rocks-blueprint	`43.97% <ø> (-0.03%)`	⬇️
contracts-rocks-capybara-finance	`44.29% <ø> (ø)`
contracts-rocks-capybara-finance-v2	`44.00% <ø> (ø)`
contracts-rocks-card-payment-processor	`44.06% <ø> (ø)`
contracts-rocks-card-payment-processor-v2	`44.40% <ø> (+0.04%)`	⬆️
contracts-rocks-cashier	`43.97% <ø> (ø)`
contracts-rocks-credit-agent	`43.26% <ø> (ø)`
contracts-rocks-multisig	`43.95% <ø> (ø)`
contracts-rocks-net-yield-distributor	`43.97% <ø> (ø)`
contracts-rocks-periphery	`42.71% <ø> (ø)`
contracts-rocks-shared-wallet-controller	`44.02% <ø> (+0.02%)`	⬆️
contracts-rocks-token	`44.06% <ø> (-0.03%)`	⬇️
contracts-rocks-treasury	`43.68% <ø> (ø)`
e2e-admin-password	`22.83% <ø> (-0.03%)`	⬇️
e2e-clock-stratus	`25.69% <ø> (ø)`
e2e-genesis	`27.22% <ø> (ø)`
e2e-importer-offline	`59.97% <ø> (-0.21%)`	⬇️
e2e-rpc-downloader	`55.15% <ø> (ø)`
e2e-stratus	`57.60% <ø> (ø)`
leader-follower-	`61.70% <ø> (-0.03%)`	⬇️
rust-tests	`31.82% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

github-actions · 2026-01-29T12:55:35Z

Cargo vet still needs audits and no agent result was applied.

Unvetted dependency: uuid 1.19.0

Codex agent was not configured or did not return a response. Ensure OPENAI_API_KEY is set and the prompt is valid.

github-actions · 2026-02-03T00:56:17Z

Cargo vet still needs audits and no agent result was applied.

Unvetted dependency: uuid 1.19.0

Codex agent was not configured or did not return a response. Ensure OPENAI_API_KEY is set and the prompt is valid.

github-actions · 2026-02-03T01:18:40Z

Cargo vet still needs audits and no agent result was applied.

Unvetted dependency: uuid 1.19.0

Codex agent was not configured or did not return a response. Ensure OPENAI_API_KEY is set and the prompt is valid.

# This is the 1st commit message: deps: update uuid to version 1.19.0 # This is the commit message #2: wip: testing # This is the commit message #3: wip: testing # This is the commit message #4: wip: testing # This is the commit message #5: wip: testing # This is the commit message #6: wip: testing # This is the commit message #7: wip: testing # This is the commit message #8: wip: testing # This is the commit message #9: wip: testing # This is the commit message #10: wip: testing # This is the commit message #11: wip: testing # This is the commit message #12: wip: testing # This is the commit message #13: wip: testing # This is the commit message #14: wip: testing # This is the commit message #15: wip: testing # This is the commit message #16: wip: testing # This is the commit message #17: wip: testing # This is the commit message #18: wip: testing # This is the commit message #19: wip: testing # This is the commit message #20: wip: testing # This is the commit message #21: wip: testing # This is the commit message #22: wip: testing # This is the commit message #23: wip: testing # This is the commit message #24: wip: testing

wip: testing wip: testing wip: testing wip: testing wip: testing wip: testing wip: testing wip: testing wip: testing wip: testing wip: testing wip: testing wip: testing wip: testing wip: testing wip: testing wip: testing wip: testing wip: testing wip: testing wip: testing wip: testing wip: testing wip: testing wip: testing

github-actions · 2026-02-04T00:28:54Z

🧾 cargo-vet automated audit summary

Vetted (auto-certified): 4
Unvetted (needs manual review): 0
cargo vet --locked after apply: ✅ pass
Audit files updated: yes
Commit: 0a4e7ac
Pushed to PR branch: yes

✅ Auto-certified

security-framework-sys 2.15.0 — Diff only adds new CFStringRef extern constants and configuration metadata without introducing new unsafe logic or capability changes.
tower 0.5.2 — Diff only adjusts formatting, macro imports, and documentation; no new unsafe, I/O, networking, or other powerful behavior was introduced or expanded in the shown code.
rustls-platform-verifier 0.6.2 — Reviewed the code diff: library now threads an explicit CryptoProvider into existing platform verifiers, Android context handling adds a scoped unsafe_clone with clear lifetime constraints, and other changes remain within tests/examples (network/FS access only in opt-in example). No expanded ambient capabilities or new unsafe behavior affecting the shipped verifier were observed.
security-framework 3.5.1 — Diff primarily adds keychain option builders, refactors existing wrappers, and adjusts tests; it does not introduce new unsafe patterns, dynamic execution paths, or additional network/filesystem access beyond existing Apple Security Framework FFI usage.

github-actions · 2026-02-04T23:56:16Z

✅ cargo-vet: already fully vetted with cargo vet --locked.

No audits needed.

github-actions · 2026-02-04T23:56:37Z

🧾 cargo-vet automated audit summary

Vetted (auto-certified): 0
Unvetted (needs manual review): 0
Audit files updated: no changes to commit
cargo vet import updates: none detected

github-actions · 2026-02-05T00:16:55Z

✅ cargo-vet: already fully vetted with cargo vet --locked.

No audits needed.

github-actions · 2026-02-05T00:16:58Z

🧾 cargo-vet automated audit summary

Vetted (auto-certified): 0
Unvetted (needs manual review): 0
Audit files updated: no changes to commit
cargo vet import updates: none detected

github-actions · 2026-02-05T00:35:38Z

🧾 cargo-vet automated audit summary

Vetted (auto-certified): 3
Unvetted (needs manual review): 0
cargo vet --locked after apply: ✅ pass
Audit files updated: yes
Commit: 9a29043
Pushed to PR branch: yes

✅ Auto-certified

convert_case 0.10.0 — Library rewrite adds boundary/pattern handling, macros, and helpers without introducing unsafe code, FFI, or new ambient-capability use; no supply-chain risk observed in the shown changes.
derive_more-impl 2.1.1 — Diff adds derive implementations (e.g., cmp::eq/partial_eq, ops reorganizations) and doc updates without introducing filesystem, network, or other high-risk behavior; new unsafe usage remains bounded to enum pattern matches with prior discriminant checks.
derive_more 2.1.1 — Diff replaces vendored error coercion helper with in-crate version using core::error::Error, adds Eq helper structs, and wires new features/tests; no new unsafe, FFI, or capability-expanding behavior observed.

github-actions · 2026-02-05T01:47:51Z

🧾 cargo-vet automated audit summary

Vetted (auto-certified): 3
Unvetted (needs manual review): 0
cargo vet --locked after apply: ✅ pass
Audit files updated: yes
Commit: ca3088b
Pushed to PR branch: yes

✅ Auto-certified

convert_case 0.10.0 — Diff shows only string case-conversion logic, configuration, and tests; no unsafe code, FFI, or new ambient capability usage observed.
derive_more-impl 2.1.1 — Adds procedural macro support (Eq/PartialEq derives, rename-all handling, updated docs) and refactors existing ops derives; new unsafe blocks only guard impossible match arms after discriminant checks, so no additional supply-chain risk observed in the reviewed diff.
derive_more 2.1.1 — New code reuses core error traits, adds internal helper modules (e.g., as_dyn_error, cmp) and expands derive/test coverage without introducing unsafe blocks, FFI, or new IO/network behavior.

github-actions · 2026-02-05T02:25:15Z

🧾 cargo-vet automated audit summary

Vetted (auto-certified): 0
Unvetted (needs manual review): 0
Audit files updated: yes
Commit: ad2b1e8
Pushed to PR branch: yes
cargo vet import updates: detected (no diffs required)

bronzelle-cw force-pushed the test-vetting branch 2 times, most recently from fbdb52f to 5dbe42a Compare February 3, 2026 15:07

bronzelle-cw and others added 6 commits February 3, 2026 14:17

chore(vet): apply agent audit

91f654c

wip: testing cargo vet several diffs

a856900

wip: testing

72c355d

wip: testing multiple crates

b33ebe2

bronzelle-cw force-pushed the test-vetting branch from 5dbe42a to b33ebe2 Compare February 3, 2026 17:23

bronzelle-cw and others added 6 commits February 3, 2026 14:42

wip: testing multiple crates

7767f2b

wip: fixing commit

ef40c29

wip: testing

0e32c3f

wip: testing

ac42a47

wip: testing

7ddd023

chore(vet): apply automated audits

0a4e7ac

wip: improve ci

aa2b259

wip: improve ci

cc9915c

wip: testing

9a29043

bronzelle-cw and others added 2 commits February 4, 2026 22:43

wip: testing commit

6fa6205

chore(vet): apply automated audits

ca3088b

bronzelle-cw and others added 2 commits February 4, 2026 23:22

wip: import vet test

b822d40

chore(vet): apply automated audits

ad2b1e8

bronzelle-cw closed this Feb 20, 2026

Comments

Conversation

bronzelle-cw commented Jan 23, 2026 • edited by github-actions bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Type

Description

Diagram Walkthrough

File Walkthrough

Uh oh!

github-actions bot commented Jan 23, 2026

PR Reviewer Guide 🔍

Uh oh!

github-actions bot commented Jan 23, 2026

PR Code Suggestions ✨

Uh oh!

codecov bot commented Jan 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

github-actions bot commented Jan 29, 2026

Uh oh!

github-actions bot commented Feb 3, 2026

Uh oh!

github-actions bot commented Feb 3, 2026

Uh oh!

github-actions bot commented Feb 4, 2026

🧾 cargo-vet automated audit summary

✅ Auto-certified

Uh oh!

github-actions bot commented Feb 4, 2026

Uh oh!

github-actions bot commented Feb 4, 2026

🧾 cargo-vet automated audit summary

Uh oh!

github-actions bot commented Feb 5, 2026

Uh oh!

github-actions bot commented Feb 5, 2026

🧾 cargo-vet automated audit summary

Uh oh!

github-actions bot commented Feb 5, 2026

🧾 cargo-vet automated audit summary

✅ Auto-certified

Uh oh!

github-actions bot commented Feb 5, 2026

🧾 cargo-vet automated audit summary

✅ Auto-certified

Uh oh!

github-actions bot commented Feb 5, 2026

🧾 cargo-vet automated audit summary

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

bronzelle-cw commented Jan 23, 2026 •

edited by github-actions bot

Loading

codecov bot commented Jan 23, 2026 •

edited

Loading