kumarUjjawal opened a new pull request, #25359: URL: https://github.com/apache/datafusion/pull/25359
## Which issue does this PR close? - Part of #21048. The issue stays open for the other checklist items. ## Rationale for this change The "Security audit" workflow runs `cargo audit` with two advisory exceptions, but `dev/rust_lint.sh` has no audit step. A contributor can pass the local lint suite and find a vulnerable dependency only in CI. This PR moves the audit command and its exceptions into one script that CI and the local suite share. ## What changes are included in this PR? - `ci/scripts/security_audit.sh` is a new executable script. It audits the root `Cargo.lock` from the repository root, even when invoked from a subdirectory, with the same `--ignore` flags that CI uses today. It keeps the audit output and exit status. It requires `cargo-audit` and does not install it. The rationale for the two quick-xml exceptions moves from the workflow into the script. - `.github/workflows/audit.yml` calls the script. The workflow name, job, triggers, permissions, runner, and pinned actions do not change. Only the run line changes. - `dev/rust_lint.sh` installs `cargo-audit` when it is missing, through the existing helper, and runs the script as a read-only step after the Markdown link check and before the Rust documentation build. The `--write` and `--allow-dirty` flags never reach it. - `docs/source/contributor-guide/testing.md` documents the standalone command and why the result can change without a repository change. ## What is the testing strategy for this PR? - The workflow's inline command and the new script ran on the same `Cargo.lock` with `cargo-audit` 0.22.2 and the same advisory database. Both passed with identical findings, and no manifest or lockfile changed. - A disposable fixture with a logging `cargo` stub exercised the script. Invoked from a subdirectory, it runs the exact CI command at the repository root. It keeps the audit exit status. It reports a clear error when `cargo-audit` is missing. - A disposable fixture with stubbed steps and tools exercised the runner. The audit runs once with no arguments in check mode and in both write modes. A missing `cargo-audit` triggers the existing install path, and a present one triggers no install. An install failure stops the suite before any step, and an audit failure stops the later steps. - The parsed workflow YAML is identical to `main` except the run line. The workflow install check, the ASF status check validator, `git diff --check`, and the full `./dev/rust_lint.sh` pass on this branch. The audit workflow filters pull requests by Cargo manifest and lockfile paths, so this PR does not trigger it. The merge queue runs it without that filter. ## Are there any user-facing changes? No. The local lint suite gains the audit and installs `cargo-audit` when it is missing. CI behavior is unchanged. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
