ci-templates v2026.09.07 — the Rust audit becomes a standing check
`cargo audit` already ran in all seven Rust repos, so this is not new
coverage. It is the same job, finally able to see the advisories it was
meant to catch.
Two independent blind spots, either sufficient on its own:
Wrong time .security-audit-job extended .validation-deps — merge
requests touching Cargo.toml or Cargo.lock, nothing
else. A new advisory published against an unchanged
lockfile fired nothing, which is how advisories
normally arrive. Adds main and schedule.
Wrong severity plain `cargo audit` exits 0 on unsound, unmaintained
and yanked. RUSTSEC-2026-0253 — potential
use-after-free in LruCache::pop() — is classed
unsound, so even a scheduled run would have passed.
Now --deny warnings.
web-demo already had both, which is why web-demo was the only repo
where that advisory ever went red, three weeks after it landed in four
consumers' lockfiles.
Repos declare their own exceptions in AUDIT_IGNORES, set in top-level
`variables:` so the RC-tag audit inherits the same list. Each entry
carries the advisory's source and what clears it. Consuming repos must
land their ignore list BEFORE bumping to this tag — the other order
turns six mains red in the gap.