TEST VETTING - DO NOT APPROVE by bronzelle-cw · Pull Request #2440 · cloudwalk/stratus

bronzelle-cw · 2026-01-23T21:01:19Z

PR Type

Enhancement

Description

Introduce Dependabot Cargo Vet GitHub Actions workflow
Integrate cargo-vet with Codex agent for audits
Auto-commit audit changes on successful vetting
Bump uuid crate to version 1.19.0

Diagram Walkthrough

flowchart LR
  PR["Pull Request"]
  Checkout["Checkout PR head"]
  Setup["Set up Rust & install cargo-vet"]
  Vet["Run cargo vet --locked"]
  Exit["Exit if fully vetted"]
  Diff["Collect unvetted crate diff"]
  Prompt["Build Codex prompt"]
  Codex["Codex audit action"]
  Apply["Apply agent audits"]
  Commit["Commit audit changes"]

  PR --> Checkout
  Checkout --> Setup
  Setup --> Vet
  Vet -->|vetted| Exit
  Vet -->|unvetted| Diff
  Diff --> Prompt
  Prompt --> Codex
  Codex --> Apply
  Apply --> Commit

File Walkthrough

Relevant files

Configuration changes

dependabot-auto-vet.yml `Add Dependabot Cargo Vet workflow` .github/workflows/dependabot-auto-vet.yml Add new Dependabot Cargo Vet workflow Define steps: checkout, Rust setup, install cargo-vet Run initial vet, import audits, derive vet status Integrate Codex for automated audit and commit	+191/-0

Dependencies

Cargo.toml `Bump uuid crate to 1.19.0` Cargo.toml Bump `uuid` dependency version from 1.18.1 to 1.19.0 Retain `"v7"` feature	+1/-1

github-actions · 2026-01-23T21:02:25Z

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 2 🔵🔵⚪⚪⚪
🧪 No relevant tests
🔒 No security concerns identified
⚡ Recommended focus areas for review Fragile output parsing The shell parsing of `cargo vet` output using `grep` and simple string slicing can break if the output format changes. Consider using `cargo vet --output-format json` and a JSON parser or more robust extraction logic to reliably capture unvetted crate names and versions. run: \| # Expect a single unvetted crate from dependabot PRs; parse the line "crate:old -> new" logfile="vet-locked-final.log" if [ ! -f "$logfile" ]; then logfile="vet-locked.log" fi line="$(grep -m1 'unvetted dependencies:' -A2 "$logfile" \| tail -n1 \| tr -d '[:space:]')" crate="${line%%:}" vers="${line#:}" old="${vers%->}" new="${vers#->}" if [ -z "$crate" ] \|\| [ -z "$old" ] \|\| [ -z "$new" ]; then echo "Failed to parse unvetted crate/version from vet output" >&2 exit 1 fi Incorrect failure handling in GitHub Script The `actions/github-script` step uses `core.setFailed` without importing or referencing the `@actions/core` module. In this context you should throw an error (e.g. `throw new Error(...)`) or ensure the correct API is available. - name: Comment when agent step failed or missing if: steps.vet_status.outputs.status != '0' && (steps.codex.outcome == 'failure' \|\| steps.codex.outputs.response == '') uses: actions/github-script@v7 with: script: \| const crate = '${{ steps.collect_unvetted_and_diff.outputs.crate }}'; const version = '${{ steps.collect_unvetted_and_diff.outputs.version }}'; const msg = [ 'Cargo vet still needs audits and no agent result was applied.', '', `Unvetted dependency: ${crate} ${version}`, '', 'Codex agent was not configured or did not return a response. Ensure OPENAI_API_KEY is set and the prompt is valid.' ].join('\n'); await github.rest.issues.createComment({ owner: context.repo.owner, repo: context.repo.repo, issue_number: context.issue.number, body: msg }); core.setFailed('Agent step failed or was not configured.')

github-actions · 2026-01-23T21:03:39Z

PR Code Suggestions ✨

Explore these optional code suggestions:

Category	Suggestion	Impact
Possible issue	Capture real exit status The current pipeline always records a zero exit code because `\|\| true` resets `$?`. Capture the real exit status before forcing success. .github/workflows/dependabot-auto-vet.yml [38-43] - name: Initial cargo vet --locked id: vet_locked_initial continue-on-error: true run: \| - cargo vet --locked > vet-locked.log 2>&1 \|\| true - echo "status=$?" >> "$GITHUB_OUTPUT" + set +e + cargo vet --locked > vet-locked.log 2>&1 + status=$? + echo "status=$status" >> "$GITHUB_OUTPUT" Suggestion importance[1-10]: 8 __ Why: The `\|\| true` causes `echo` to always report success, so capturing `$?` before forcing success is crucial to detect vet failures.	Medium
General	Sanitize notes for CLI If the `notes` field contains quotes or newlines, the CLI call can break. Normalize newlines to spaces and escape quotes before passing to `--notes`. .github/workflows/dependabot-auto-vet.yml [169] -cargo vet certify "$crate" "$version" --criteria "$criteria" --who "$who" --notes "$notes" --accept-all +safe_notes=$(echo "$notes" \| tr '\n' ' ' \| sed 's/\"/\\"/g') +cargo vet certify "$crate" "$version" --criteria "$criteria" --who "$who" --notes "$safe_notes" --accept-all Suggestion importance[1-10]: 6 __ Why: Normalizing newlines and escaping quotes in `notes` prevents malformed command lines and potential script failures when calling `cargo vet certify`.	Low
General	Enable pushing new commits To allow pushing audit commits back to the PR branch, the checkout action needs the full history. Add `fetch-depth: 0` so Git can create and push new commits. .github/workflows/dependabot-auto-vet.yml [22-26] - name: Checkout PR head uses: actions/checkout@v4 with: ref: ${{ github.event.pull_request.head.sha }} persist-credentials: true + fetch-depth: 0 Suggestion importance[1-10]: 5 __ Why: Adding `fetch-depth: 0` ensures the full Git history is available, which is necessary for creating and pushing audit commits back to the PR.	Low

codecov · 2026-01-23T21:07:35Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 0.00%. Comparing base (d5188d5) to head (0670569).
⚠️ Report is 5 commits behind head on main.

❗ There is a different number of reports uploaded between BASE (d5188d5) and HEAD (0670569). Click for more details.

HEAD has 39 uploads less than BASE

Flag BASE (d5188d5) HEAD (0670569)

e2e-genesis 1 0

e2e-stratus 3 0

e2e-admin-password 1 0

e2e-clock-stratus 1 0

e2e-rpc-downloader 1 0

e2e-importer-offline 1 0

contracts-rocks-asset-transit-desk 1 0

contracts-rocks-periphery 1 0

contracts-rocks-balance-freezer 1 0

contracts-rocks-base 1 0

contracts-rocks-net-yield-distributor 1 0

contracts-rocks-blueprint 1 0

contracts-rocks-multisig 1 0

contracts-rocks-shared-wallet-controller 1 0

contracts-rocks-treasury 1 0

contracts-rocks-token 1 0

contracts-rocks-cashier 1 0

leader-follower- 14 0

contracts-rocks-capybara-finance 1 0

contracts-rocks-card-payment-processor 1 0

contracts-rocks-card-payment-processor-v2 1 0

contracts-rocks-capybara-finance-v2 1 0

contracts-rocks-credit-agent 1 0

contracts-rocks-balance-tracker 1 0

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #2440       +/-   ##
==========================================
- Coverage   84.41%   0.00%   -84.42%     
==========================================
  Files         141     140        -1     
  Lines       10808    9163     -1645     
==========================================
- Hits         9124       0     -9124     
- Misses       1684    9163     +7479

Flag	Coverage Δ
contracts-rocks-asset-transit-desk	`?`
contracts-rocks-balance-freezer	`?`
contracts-rocks-balance-tracker	`?`
contracts-rocks-base	`?`
contracts-rocks-blueprint	`?`
contracts-rocks-capybara-finance	`?`
contracts-rocks-capybara-finance-v2	`?`
contracts-rocks-card-payment-processor	`?`
contracts-rocks-card-payment-processor-v2	`?`
contracts-rocks-cashier	`?`
contracts-rocks-credit-agent	`?`
contracts-rocks-multisig	`?`
contracts-rocks-net-yield-distributor	`?`
contracts-rocks-periphery	`?`
contracts-rocks-shared-wallet-controller	`?`
contracts-rocks-token	`?`
contracts-rocks-treasury	`?`
e2e-admin-password	`?`
e2e-clock-stratus	`?`
e2e-genesis	`?`
e2e-importer-offline	`?`
e2e-rpc-downloader	`?`
e2e-stratus	`?`
leader-follower-	`?`
rust-tests	`0.00% <ø> (-30.73%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

github-actions · 2026-01-29T12:55:35Z

Cargo vet still needs audits and no agent result was applied.

Unvetted dependency: uuid 1.19.0

Codex agent was not configured or did not return a response. Ensure OPENAI_API_KEY is set and the prompt is valid.

github-actions · 2026-02-03T00:56:17Z

Cargo vet still needs audits and no agent result was applied.

Unvetted dependency: uuid 1.19.0

Codex agent was not configured or did not return a response. Ensure OPENAI_API_KEY is set and the prompt is valid.

github-actions · 2026-02-03T01:18:40Z

Cargo vet still needs audits and no agent result was applied.

Unvetted dependency: uuid 1.19.0

Codex agent was not configured or did not return a response. Ensure OPENAI_API_KEY is set and the prompt is valid.

# This is the 1st commit message: deps: update uuid to version 1.19.0 # This is the commit message #2: wip: testing # This is the commit message #3: wip: testing # This is the commit message #4: wip: testing # This is the commit message #5: wip: testing # This is the commit message #6: wip: testing # This is the commit message #7: wip: testing # This is the commit message #8: wip: testing # This is the commit message #9: wip: testing # This is the commit message #10: wip: testing # This is the commit message #11: wip: testing # This is the commit message #12: wip: testing # This is the commit message #13: wip: testing # This is the commit message #14: wip: testing # This is the commit message #15: wip: testing # This is the commit message #16: wip: testing # This is the commit message #17: wip: testing # This is the commit message #18: wip: testing # This is the commit message #19: wip: testing # This is the commit message #20: wip: testing # This is the commit message #21: wip: testing # This is the commit message #22: wip: testing # This is the commit message #23: wip: testing # This is the commit message #24: wip: testing

wip: testing wip: testing wip: testing wip: testing wip: testing wip: testing wip: testing wip: testing wip: testing wip: testing wip: testing wip: testing wip: testing wip: testing wip: testing wip: testing wip: testing wip: testing wip: testing wip: testing wip: testing wip: testing wip: testing wip: testing wip: testing

github-actions · 2026-02-04T00:28:54Z

🧾 cargo-vet automated audit summary

Vetted (auto-certified): 4
Unvetted (needs manual review): 0
cargo vet --locked after apply: ✅ pass
Audit files updated: yes
Commit: 0a4e7ac
Pushed to PR branch: yes

✅ Auto-certified

security-framework-sys 2.15.0 — Diff only adds new CFStringRef extern constants and configuration metadata without introducing new unsafe logic or capability changes.
tower 0.5.2 — Diff only adjusts formatting, macro imports, and documentation; no new unsafe, I/O, networking, or other powerful behavior was introduced or expanded in the shown code.
rustls-platform-verifier 0.6.2 — Reviewed the code diff: library now threads an explicit CryptoProvider into existing platform verifiers, Android context handling adds a scoped unsafe_clone with clear lifetime constraints, and other changes remain within tests/examples (network/FS access only in opt-in example). No expanded ambient capabilities or new unsafe behavior affecting the shipped verifier were observed.
security-framework 3.5.1 — Diff primarily adds keychain option builders, refactors existing wrappers, and adjusts tests; it does not introduce new unsafe patterns, dynamic execution paths, or additional network/filesystem access beyond existing Apple Security Framework FFI usage.

github-actions · 2026-02-04T23:56:16Z

✅ cargo-vet: already fully vetted with cargo vet --locked.

No audits needed.

github-actions · 2026-02-04T23:56:37Z

🧾 cargo-vet automated audit summary

Vetted (auto-certified): 0
Unvetted (needs manual review): 0
Audit files updated: no changes to commit
cargo vet import updates: none detected

github-actions · 2026-02-05T00:16:55Z

✅ cargo-vet: already fully vetted with cargo vet --locked.

No audits needed.

github-actions · 2026-02-05T00:16:58Z

🧾 cargo-vet automated audit summary

Vetted (auto-certified): 0
Unvetted (needs manual review): 0
Audit files updated: no changes to commit
cargo vet import updates: none detected

github-actions · 2026-02-05T00:35:38Z

🧾 cargo-vet automated audit summary

Vetted (auto-certified): 3
Unvetted (needs manual review): 0
cargo vet --locked after apply: ✅ pass
Audit files updated: yes
Commit: 9a29043
Pushed to PR branch: yes

✅ Auto-certified

convert_case 0.10.0 — Library rewrite adds boundary/pattern handling, macros, and helpers without introducing unsafe code, FFI, or new ambient-capability use; no supply-chain risk observed in the shown changes.
derive_more-impl 2.1.1 — Diff adds derive implementations (e.g., cmp::eq/partial_eq, ops reorganizations) and doc updates without introducing filesystem, network, or other high-risk behavior; new unsafe usage remains bounded to enum pattern matches with prior discriminant checks.
derive_more 2.1.1 — Diff replaces vendored error coercion helper with in-crate version using core::error::Error, adds Eq helper structs, and wires new features/tests; no new unsafe, FFI, or capability-expanding behavior observed.

github-actions · 2026-02-05T01:47:51Z

🧾 cargo-vet automated audit summary

Vetted (auto-certified): 3
Unvetted (needs manual review): 0
cargo vet --locked after apply: ✅ pass
Audit files updated: yes
Commit: ca3088b
Pushed to PR branch: yes

✅ Auto-certified

convert_case 0.10.0 — Diff shows only string case-conversion logic, configuration, and tests; no unsafe code, FFI, or new ambient capability usage observed.
derive_more-impl 2.1.1 — Adds procedural macro support (Eq/PartialEq derives, rename-all handling, updated docs) and refactors existing ops derives; new unsafe blocks only guard impossible match arms after discriminant checks, so no additional supply-chain risk observed in the reviewed diff.
derive_more 2.1.1 — New code reuses core error traits, adds internal helper modules (e.g., as_dyn_error, cmp) and expands derive/test coverage without introducing unsafe blocks, FFI, or new IO/network behavior.

github-actions · 2026-02-05T02:25:15Z

🧾 cargo-vet automated audit summary

Vetted (auto-certified): 0
Unvetted (needs manual review): 0
Audit files updated: yes
Commit: ad2b1e8
Pushed to PR branch: yes
cargo vet import updates: detected (no diffs required)

github-actions · 2026-03-11T19:49:50Z

🧾 cargo-vet automated audit summary

Vetted (auto-certified): 3
Unvetted (needs manual review): 0
Codex reasoning: active
cargo vet --locked after apply: ✅ pass
Patch generated: yes
Artifact uploaded: yes
Artifact name: dependabot-auto-vet-patch-pr-2440
Artifact ID: 5878221244
Retention: 90 days
Artifact download: https://github.com/cloudwalk/stratus/actions/runs/22971298476/artifacts/5878221244

CI did not commit anything. Review the patch locally and create the final signed commit yourself.

Apply the patch locally

The patch artifact is attached to this workflow run as a zip archive. Download it, extract auto-vet.patch, review the result, then create your signed commit.

git checkout <pr-branch>
curl -L \
  -H "Authorization: Bearer <github-token>" \
  -o auto-vet-artifact.zip \
  https://github.com/cloudwalk/stratus/actions/runs/22971298476/artifacts/5878221244
unzip -p auto-vet-artifact.zip auto-vet.patch > auto-vet.patch
git apply --index auto-vet.patch
git status
git commit -S -m "chore(vet): apply automated audits"
git push

✅ Auto-certified

security-framework-sys 2.15.0 — Observed only new extern CFStringRef bindings (authentication UI and synchronizable constants) with existing patterns; no additional unsafe behavior, build logic, or capability changes introduced in the diff.
rustls-platform-verifier 0.6.2 — Reviewed the JNI refactor: the sole new unsafe JNIEnv::unsafe_clone stays confined to the local frame and isn’t exposed outside the closure, preserving prior invariants. No other library code paths gained filesystem, network, or execution-sensitive behavior.
security-framework 3.5.1 — Changes add keychain option APIs, extend password utilities, and add a guarded runtime lookup for SecTrustEvaluateWithError without introducing new filesystem, network, or high-risk unsafe behavior beyond the controlled dlsym pointer handling shown in the diff.

github-actions · 2026-03-11T20:08:52Z

✅ cargo-vet: already fully vetted with cargo vet --locked.

No audits needed.

github-actions · 2026-03-11T20:08:55Z

🧾 cargo-vet automated audit summary

Vetted (auto-certified): 0
Unvetted (needs manual review): 0
Patch generated: no audit files were produced
cargo vet import updates: none detected

CI did not commit anything. Review the patch locally and create the final signed commit yourself.

github-actions · 2026-03-11T20:19:40Z

🧾 cargo-vet automated audit summary

Vetted (auto-certified): 1
Unvetted (needs manual review): 0
Codex reasoning: active
cargo vet --locked after apply: ✅ pass
Patch generated: yes
Artifact uploaded: yes
Artifact name: dependabot-auto-vet-patch-pr-2440
Artifact ID: 5878716214
PR number: 2440
Run ID: 22972478570
Retention: 90 days
Artifact download: https://github.com/cloudwalk/stratus/actions/runs/22972478570/artifacts/5878716214

CI did not commit anything. Review the patch locally and create the final signed commit yourself.

Apply the patch locally

The patch artifact is attached to this workflow run as a zip archive. Download it, extract auto-vet.patch, review the result, then create your signed commit.

Preferred: GitHub CLI

git checkout <pr-branch>
gh run download 22972478570 -n dependabot-auto-vet-patch-pr-2440
git apply --index dependabot-auto-vet-patch-pr-2440/auto-vet.patch
git status
git commit -S -m "chore(vet): apply automated audits"
git push

Fallback: direct artifact download

git checkout <pr-branch>
curl -L \
  -H "Authorization: Bearer <github-token>" \
  -o auto-vet-artifact.zip \
  https://github.com/cloudwalk/stratus/actions/runs/22972478570/artifacts/5878716214
unzip -p auto-vet-artifact.zip vet/auto-vet.patch > auto-vet.patch
git apply --index auto-vet.patch
git status
git commit -S -m "chore(vet): apply automated audits"
git push

✅ Auto-certified

oneshot 0.2.1 — Refactor redistributes existing channel logic into dedicated modules (e.g., new channel.rs, sender.rs, receiver.rs) with the same unsafe patterns while tightening memory-ordering via added fences; no new capabilities such as I/O, FFI, or broader unsafe surfaces were introduced in the shown code.

bronzelle-cw force-pushed the test-vetting branch 2 times, most recently from fbdb52f to 5dbe42a Compare February 3, 2026 15:07

bronzelle-cw and others added 6 commits February 3, 2026 14:17

chore(vet): apply agent audit

91f654c

wip: testing cargo vet several diffs

a856900

wip: testing

72c355d

wip: testing multiple crates

b33ebe2

bronzelle-cw force-pushed the test-vetting branch from 5dbe42a to b33ebe2 Compare February 3, 2026 17:23

bronzelle-cw and others added 6 commits February 3, 2026 14:42

wip: testing multiple crates

7767f2b

wip: fixing commit

ef40c29

wip: testing

0e32c3f

wip: testing

ac42a47

wip: testing

7ddd023

chore(vet): apply automated audits

0a4e7ac

wip: improve ci

aa2b259

wip: improve ci

cc9915c

wip: testing

9a29043

bronzelle-cw and others added 2 commits February 4, 2026 22:43

wip: testing commit

6fa6205

chore(vet): apply automated audits

ca3088b

bronzelle-cw and others added 2 commits February 4, 2026 23:22

wip: import vet test

b822d40

chore(vet): apply automated audits

ad2b1e8

wip: improve script

f0d3b99

bronzelle-cw closed this Feb 20, 2026

feat(vet): implement auto-vet patch generation and upload process

aebdd3f

bronzelle-cw reopened this Mar 11, 2026

bronzelle-cw added 2 commits March 11, 2026 16:39

Merge branch 'create-pr-override-during-vetting' into test-vetting

0814a83

wip: allow all pull requests to trigger the vet job

c083d70

chore(vet): apply automated audits

6a80654

bronzelle-cw added 2 commits March 11, 2026 17:15

ci(vet): update patch download suggestion

a308802

bump oneshot version 0.1.11 -> 0.2.1

0670569

Conversation

bronzelle-cw commented Jan 23, 2026 • edited by github-actions bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Type

Description

Diagram Walkthrough

File Walkthrough

Uh oh!

github-actions bot commented Jan 23, 2026

PR Reviewer Guide 🔍

Uh oh!

github-actions bot commented Jan 23, 2026

PR Code Suggestions ✨

Uh oh!

codecov bot commented Jan 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

github-actions bot commented Jan 29, 2026

Uh oh!

github-actions bot commented Feb 3, 2026

Uh oh!

github-actions bot commented Feb 3, 2026

Uh oh!

github-actions bot commented Feb 4, 2026

🧾 cargo-vet automated audit summary

✅ Auto-certified

Uh oh!

github-actions bot commented Feb 4, 2026

Uh oh!

github-actions bot commented Feb 4, 2026

🧾 cargo-vet automated audit summary

Uh oh!

github-actions bot commented Feb 5, 2026

Uh oh!

github-actions bot commented Feb 5, 2026

🧾 cargo-vet automated audit summary

Uh oh!

github-actions bot commented Feb 5, 2026

🧾 cargo-vet automated audit summary

✅ Auto-certified

Uh oh!

github-actions bot commented Feb 5, 2026

🧾 cargo-vet automated audit summary

✅ Auto-certified

Uh oh!

github-actions bot commented Feb 5, 2026

🧾 cargo-vet automated audit summary

Uh oh!

github-actions bot commented Mar 11, 2026

🧾 cargo-vet automated audit summary

Apply the patch locally

✅ Auto-certified

Uh oh!

github-actions bot commented Mar 11, 2026

Uh oh!

github-actions bot commented Mar 11, 2026

🧾 cargo-vet automated audit summary

Uh oh!

github-actions bot commented Mar 11, 2026

🧾 cargo-vet automated audit summary

Apply the patch locally

✅ Auto-certified

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

bronzelle-cw commented Jan 23, 2026 •

edited by github-actions bot

Loading

codecov bot commented Jan 23, 2026 •

edited

Loading