From af24efcfb135bdf3dd98462498f8faf57b36d62e Mon Sep 17 00:00:00 2001 From: Lars Francke Date: Mon, 20 Jul 2026 09:25:22 +0200 Subject: [PATCH] ci(template): build cargo-audit against stable rust toolchain The daily security audit builds cargo-audit from source using the toolchain pinned in rust-toolchain.toml. A transitive build dependency (kstring 2.0.4) now requires Rust 1.96.0, which is newer than the pinned channel, so the build fails and the audit never runs. Override RUSTUP_TOOLCHAIN=stable for the audit step so cargo-audit is built with current stable. The toolchain used to build the tool does not affect the audit result, so this is safe. Co-Authored-By: Claude Opus 4.8 (1M context) --- template/.github/workflows/general_daily_security.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/template/.github/workflows/general_daily_security.yml b/template/.github/workflows/general_daily_security.yml index d4c7825c..8b76446b 100644 --- a/template/.github/workflows/general_daily_security.yml +++ b/template/.github/workflows/general_daily_security.yml @@ -20,5 +20,10 @@ jobs: with: persist-credentials: false - uses: rustsec/audit-check@69366f33c96575abad1ee0dba8212993eecbe998 # v2.0.0 + # Build against stable because cargo-audit sometimes depends on things + # that require a newer Rust version than our pinned toolchain. This does + # not influence the result, so it should be safe. + env: + RUSTUP_TOOLCHAIN: stable with: token: ${{ secrets.GITHUB_TOKEN }}