Repository navigation
Require Rust advisory checks, Clippy and real-WASM property regressions - #2
Open
dotmantissa wants to merge 2 commits into
Open
dotmantissa wants to merge 2 commits into
dotmantissa wants to merge 2 commits into
Conversation
dotmantissa
enabled auto-merge
November 3, 2026 17:22
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PR validation did not execute Clippy or audit Rust advisories. Require strict pinned Semgrep scanning, workflow privilege/secret rejection tests, cargo-audit 0.22.2, warning-free workspace/all-target Clippy and weekly validation. Expand sensitive CODEOWNERS and Cargo/pip Dependabot updates. Vendored security rules include license and immutable checked provenance.
Add a bounded 18-case share/route property sweep against real pinned WASM: measure output, reject output + 1 with full ledger rollback, reject neighboring-share authorization, accept the exact minimum, reconcile balances and reject replay without writes. Narrow lint annotations preserve existing event/ABI signatures; deprecated deployment mutation APIs change only in test fixtures.
RustSec currently flags RUSTSEC-2026-0387 / crypto-bigint 0.5.5 in the pinned Soroban native test host. The reviewed policy is limited to that exact tuple and expires 2027-01-01. Every run proves crypto-bigint and soroban-env-host are absent from both normal deployed wasm32v1-none graphs; other findings, changed versions, guest presence, expiry and obsolete exceptions fail closed. Fixtures use mocked authorization/public verification inputs, not production secret scalar operations. Updating to the patched major requires an upstream SDK transition. The unmaintained paste notice stays visible; unsoundness warnings block. See CI_SECURITY.md and the policy for review rationale.
Validation: all 19 compiled-WASM tests, formatting, strict Clippy, scoped RustSec audit, SAST and SQL/eval/workflow/advisory rejection checks, Gitleaks, Actionlint and immutable sibling compatibility pass locally. Rebuilt guard 515bcffd6ee75c51cf4ff65b054751e562a5f6ad8814cce4c9b9572942e91269 and migration 849e722114e5d48c3f4768590e3d6636045da8f5d3877aaafe71add36f834f6c exactly match deployed pins. Historical artifact/provenance records are preserved. Protected main still requires an independent code-owner approval.