Domain: Reliability
Tier: 🟡 Medium
Description:
Problem: In dependency-scan.yml, the first cargo audit --deny warnings step is marked continue-on-error: true, then a follow-up step only parses .advisory.severity == "critical" and exits non-zero solely for critical findings (lines 24-56) -- high-severity Rust CVEs are logged but never fail the build. This is inconsistent with the npm audit in the same file, which fails on both critical and high (lines 78-88), and inconsistent with test.yml's contracts-crate audit, which runs without continue-on-error.
Implementation: Remove continue-on-error and use cargo audit --deny warnings (or check for high in the JSON filter too) uniformly across Rust crates.
Dependencies:
None
Acceptance Criteria:
- High-severity Rust dependency advisories fail the CI job, not just critical ones
- The Rust audit gate behaves consistently across services/api and contracts/predict-iq
- A test run against a dependency with a known high-severity advisory fails the job as expected
Testing Requirements:
- Run
cd services/api && cargo audit --deny warnings locally against a dependency with a known high-severity advisory and confirm it exits non-zero.
- Re-run dependency-scan.yml and confirm the job fails (not just logs) on a high-severity finding.
PR Checklist:
Filed from an automated multi-agent codebase audit; every finding was independently fact-checked against the code at audit time.
Domain: Reliability
Tier: 🟡 Medium
Description:
Problem: In dependency-scan.yml, the first cargo audit --deny warnings step is marked continue-on-error: true, then a follow-up step only parses .advisory.severity == "critical" and exits non-zero solely for critical findings (lines 24-56) -- high-severity Rust CVEs are logged but never fail the build. This is inconsistent with the npm audit in the same file, which fails on both critical and high (lines 78-88), and inconsistent with test.yml's contracts-crate audit, which runs without continue-on-error.
Implementation: Remove continue-on-error and use cargo audit --deny warnings (or check for high in the JSON filter too) uniformly across Rust crates.
Dependencies:
None
Acceptance Criteria:
Testing Requirements:
cd services/api && cargo audit --deny warningslocally against a dependency with a known high-severity advisory and confirm it exits non-zero.PR Checklist:
fix/rust-dependency-audit-only-fails-ci-on-critical).actionlint .github/workflows/dependency-scan.ymlpasses with zero warnings.Filed from an automated multi-agent codebase audit; every finding was independently fact-checked against the code at audit time.