Repository navigation
Conversation
|
Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually. Contributors can view more details about this message here. |
roivanov
added
ci
cutile-rs/deny.toml was never executed, so an advisory in that lock could not fail CI. Fixes NVIDIA#1620 Signed-off-by: Roman Ivanov <rivanov@nvidia.com>
roivanov
force-pushed
the
ci/cutile-cargo-deny
branch
from
October 23, 2026 17:54
a22ac18 to
8ab6f7f
Compare
Collaborator
Author
|
/ok to test 8ab6f7f |
roivanov
marked this pull request as ready for review
October 23, 2026 19:14
roivanov
requested review from
binarybana,
cryos,
elibol,
kkraus14,
nihalpasham and
rparolin
as code owners
October 23, 2026 19:14
roivanov
marked this pull request as draft
October 23, 2026 19:27
ci.yml's path filters skip cutile-rs, so a lock, manifest, or deny.toml change there never reached the new audit. Signed-off-by: Roman Ivanov <rivanov@nvidia.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes #1620.
cutile-rs/deny.tomlwas never executed, so an advisory incutile-rs/Cargo.lockcould not fail CI. This addscargo deny --manifest-path cutile-rs/Cargo.toml --locked checkto thecargo-denyworkflow and tojust check-guards. The walk starts at that manifest, so it usescutile-rs/deny.tomlrather than the Oxide policy.The paper benchmark locks stay out.
launch_overhead_rustpatches its dependencies to a path outside this tree.Why a separate workflow
The cutile-rs step inside
cargo-deny.ymlonly runs whenci.ymlruns. That caller's path filters arecuda-oxide/**, the shared host crates, the rootCargo.tomlandCargo.lock, and.github/workflows/**. A pull request that only changescutile-rs/Cargo.lock, a Tile manifest, orcutile-rs/deny.tomlnever startsci.yml, so the audit does not run. This pull request itself only reaches that step because it edits a workflow file.Adding those Tile paths to
ci.ymlwould also run formatting, clippy, and the unit tests.cutile-rs.ymlis the wrong host too: its runners do not acceptpull_request, and a path filter on the copy-pr-bot mirror push is dropped when GitHub reports that push as having no changed files.cutile-cargo-deny.ymlruns that one command onpull_requestand on pushes tomain, only for the Tile lock, Tile manifests, andcutile-rs/deny.toml. The repository status badge includes it, so a failure onmaindoes not stay green. Paper locks match the path globs and are still not audited.Depends on
#1619 has merged, which moves
cutile-rstokiofrom 1.52.1 to 1.54.1. This branch includes that commit, so the new step can pass.Test plan
cargo deny --manifest-path cutile-rs/Cargo.toml --locked checkpassesjust check-guardsruns the same commanddeny.tomlchange runscutile-rs cargo-denywithout startingci.yml