[turmelclem]

Content

improve nightly dispatcher with yanked and unmaintained crates verification :

• add a advisories section in the existing deny.toml (no impact for the current cargo-deny check licenses execution)
• add a job in the nightly-dispatcher.yml to run cargo-deny check advisories
  • it will put in error any yanked and vulnerabilities that are not in ignore section
  • we can flag in ignore section known crates that we want to replace in the future
• introduce a new weekly job running a full check advisories for yanked, unmaintained and vulnerabilities (no ignore)

Pre-submit checklist

• Branch
  • Tests are provided (if possible)
  • Crates versions are updated (if relevant)
  • CHANGELOG file is updated (if relevant)
  • Commit sequence broadly makes sense
  • Key commits have useful messages
• PR
  • All check jobs of the CI have succeeded
  • Self-reviewed the diff
  • Useful pull request description
  • Reviewer requested
• Documentation
  • Update README file (if relevant)
  • Update documentation website (if relevant)
  • Add dev blog post (if relevant)
  • Add ADR blog post or Dev ADR entry (if relevant)
  • No new TODOs introduced

Comments

Can be manually run :

• installation : cargo install --locked cargo-deny
• run : cargo deny check advisories

Issue(s)

his PR relates to or closes #3589

[github-actions]

Test Results

     5 files  ±0     226 suites  ±0   47m 32s ⏱️ -33s
 3 983 tests ±0   3 983 ✅ ±0  0 💤 ±0  0 ❌ ±0 
12 596 runs  ±0  12 596 ✅ ±0  0 💤 ±0  0 ❌ ±0 

Results for commit e75fbdd. ± Comparison against base commit b57fd15.

♻️ This comment has been updated with latest results.

[Copilot]

🟡 Changes recommended

The weekly workflow contains an invalid step that prevents the check from running.

2 open findings

• Invalid GitHub Actions step lacks run or uses · New
• Ignore rationale incorrectly describes rustls as transitive · New

What changed in this PR

Adds cargo-deny advisory checks for nightly and weekly CI, covering yanked, vulnerable, and unmaintained crates.

Changes:

• Adds advisory policies and known exceptions.
• Adds nightly advisory validation.
• Adds a strict weekly advisory scan.

File	Description	Review note
deny.toml	Advisory handling and ignores	Clarify the rationale for the direct rustls dependency exception.
.github/​workflows/​weekly-dispatcher.yml	Weekly full advisory check	Fix the invalid step lacking run or uses.
.github/​workflows/​nightly-dispatcher.yml	Nightly advisory check	—
.config/​deny-full.toml	Strict weekly advisory configuration	—

🧠 Review effort: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Alenar]

LGTM, about the ignore list, maybe we should raise an error instead of a warning if an ignore advisories go unused (which may after every-time we update our dependencies).
Else I fear that the list will grow indefinitly.

[jpraynaud]

LGTM 👍