From b3250976027de1c39f94c0cc86c818f5d3492bb2 Mon Sep 17 00:00:00 2001
From: Andy Dixon <andy@andydixon.com>
Date: Mon, 12 Oct 2026 09:19:57 +0100
Subject: [PATCH] ci: least-privilege token, SHA-pinned actions, cargo audit
 job

- ci.yml declares permissions: contents: read instead of the default
  token scope.
- Every action is pinned to the commit its current tag points at
  (checkout v4.4.0, upload-artifact v4.6.2, action-gh-release v2.6.2),
  so a moved tag can't change what runs with release write access.
- A cargo audit job runs on every push; the single ignored advisory
  (RUSTSEC-2023-0071, rsa via russh, no fix available) is recorded with
  its rationale in rust/.cargo/audit.toml (SEC-20261012-019, -012).

Release signing and macOS notarisation are not part of this change.
---
 .github/workflows/ci.yml             | 17 ++++++++++++++++-
 .github/workflows/release-builds.yml |  6 +++---
 rust/.cargo/audit.toml               |  9 +++++++++
 3 files changed, 28 insertions(+), 4 deletions(-)
 create mode 100644 rust/.cargo/audit.toml

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 20a2c5e..0260bd4 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -5,6 +5,9 @@ on:
         branches: ["**"]
     pull_request:
 
+permissions:
+    contents: read
+
 jobs:
     test:
         name: Test (${{ matrix.os }})
@@ -18,7 +21,7 @@ jobs:
                 shell: bash
                 working-directory: rust
         steps:
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
             - name: Linux dependencies (GUI libs, and sshd for the SSH integration tests)
               if: runner.os == 'Linux'
               run: |
@@ -27,3 +30,15 @@ jobs:
             - run: cargo test --locked --workspace
             - run: cargo fmt --all --check
             - run: cargo clippy --locked --workspace --all-targets -- -D warnings
+
+    audit:
+        name: Dependency audit
+        runs-on: ubuntu-22.04
+        defaults:
+            run:
+                working-directory: rust
+        steps:
+            - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+            - run: cargo install cargo-audit --locked
+            # Ignored advisories and their reasons live in rust/.cargo/audit.toml.
+            - run: cargo audit
diff --git a/.github/workflows/release-builds.yml b/.github/workflows/release-builds.yml
index 64fe0c6..16f69d2 100644
--- a/.github/workflows/release-builds.yml
+++ b/.github/workflows/release-builds.yml
@@ -28,7 +28,7 @@ jobs:
                 shell: bash
                 working-directory: rust
         steps:
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
               with:
                   fetch-depth: 0
 
@@ -51,7 +51,7 @@ jobs:
               run: ./release.sh
 
             - name: Upload artefacts
-              uses: actions/upload-artifact@v4
+              uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
               with:
                   name: nexus-terminal-${{ matrix.runner }}
                   path: |
@@ -61,6 +61,6 @@ jobs:
 
             - name: Attach to GitHub Release
               if: startsWith(github.ref, 'refs/tags/')
-              uses: softprops/action-gh-release@v2
+              uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2
               with:
                   files: build/releases/*/NexusTerminal-*.zip
diff --git a/rust/.cargo/audit.toml b/rust/.cargo/audit.toml
new file mode 100644
index 0000000..88638bd
--- /dev/null
+++ b/rust/.cargo/audit.toml
@@ -0,0 +1,9 @@
+# cargo audit configuration (CI runs `cargo audit` from rust/).
+[advisories]
+ignore = [
+    # 2026-10-12: rsa Marvin timing side channel, pulled in by russh's `rsa` feature. No fixed
+    # release exists. The client signs once per user-initiated connection, so collecting enough
+    # timings is impractical; Ed25519 is the default for generated keys. Re-check when rsa ships a
+    # constant-time release (SEC-20261012-012).
+    "RUSTSEC-2023-0071",
+]