(datafusion) 01/01: dev: include security auditing in the local lint suite (#25359)

[gi...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

github-merge-queue[bot] pushed a commit to branch gh-readonly-queue/main/pr-25359-86ba5e05fccc3e9e79f6d19ee5888c46fbb31117
in repository https://gitbox.apache.org/repos/asf/datafusion.git

commit 606ae0f697380a5bb903909f7ee3c731abbc6b79
Author: Kumar Ujjawal <uj...@gmail.com>
AuthorDate: Wed Sep 16 12:21:18 2026 +0000

    dev: include security auditing in the local lint suite (#25359)
    
    ## Which issue does this PR close?
    
    - Part of #21048. The issue stays open for the other checklist items.
    
    ## Rationale for this change
    
    The "Security audit" workflow runs `cargo audit` with two advisory
    exceptions, but `dev/rust_lint.sh` has no audit step. A contributor can
    pass the local lint suite and find a vulnerable dependency only in CI.
    This PR moves the audit command and its exceptions into one script that
    CI and the local suite share.
    
    ## What changes are included in this PR?
    
    - `ci/scripts/security_audit.sh` is a new executable script. It audits
    the root `Cargo.lock` from the repository root, even when invoked from a
    subdirectory, with the same `--ignore` flags that CI uses today. It
    keeps the audit output and exit status. It requires `cargo-audit` and
    does not install it. The rationale for the two quick-xml exceptions
    moves from the workflow into the script.
    - `.github/workflows/audit.yml` calls the script. The workflow name,
    job, triggers, permissions, runner, and pinned actions do not change.
    Only the run line changes.
    - `dev/rust_lint.sh` installs `cargo-audit` when it is missing, through
    the existing helper, and runs the script as a read-only step after the
    Markdown link check and before the Rust documentation build. The
    `--write` and `--allow-dirty` flags never reach it.
    - `docs/source/contributor-guide/testing.md` documents the standalone
    command and why the result can change without a repository change.
    
    ## What is the testing strategy for this PR?
    
    - The workflow's inline command and the new script ran on the same
    `Cargo.lock` with `cargo-audit` 0.22.2 and the same advisory database.
    Both passed with identical findings, and no manifest or lockfile
    changed.
    - A disposable fixture with a logging `cargo` stub exercised the script.
    Invoked from a subdirectory, it runs the exact CI command at the
    repository root. It keeps the audit exit status. It reports a clear
    error when `cargo-audit` is missing.
    - A disposable fixture with stubbed steps and tools exercised the
    runner. The audit runs once with no arguments in check mode and in both
    write modes. A missing `cargo-audit` triggers the existing install path,
    and a present one triggers no install. An install failure stops the
    suite before any step, and an audit failure stops the later steps.
    - The parsed workflow YAML is identical to `main` except the run line.
    The workflow install check, the ASF status check validator, `git diff
    --check`, and the full `./dev/rust_lint.sh` pass on this branch.
    
    The audit workflow filters pull requests by Cargo manifest and lockfile
    paths, so this PR does not trigger it. The merge queue runs it without
    that filter.
    
    ## Are there any user-facing changes?
    
    No. The local lint suite gains the audit and installs `cargo-audit` when
    it is missing. CI behavior is unchanged.
    
    🤖 Generated with [Claude Code](https://claude.com/claude-code)
---
 .github/workflows/audit.yml              |  6 +---
 ci/scripts/security_audit.sh             | 51 ++++++++++++++++++++++++++++++++
 dev/rust_lint.sh                         |  2 ++
 docs/source/contributor-guide/testing.md | 15 ++++++++++
 4 files changed, 69 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml
index e6122d56ac..5a2471e935 100644
--- a/.github/workflows/audit.yml
+++ b/.github/workflows/audit.yml
@@ -49,8 +49,4 @@ jobs:
         with:
           tool: cargo-audit
       - name: Run audit check
-        # Note: you can ignore specific RUSTSEC issues using the `--ignore` flag ,for example:
-        # run: cargo audit --ignore RUSTSEC-2026-0001
-        # TODO: remove once object_store upgrades to quick-xml >= 0.41.0
-        # https://github.com/apache/datafusion/issues/23297
-        run: cargo audit --ignore RUSTSEC-2026-0194 --ignore RUSTSEC-2026-0195
+        run: bash ci/scripts/security_audit.sh
diff --git a/ci/scripts/security_audit.sh b/ci/scripts/security_audit.sh
new file mode 100755
index 0000000000..eeca0799c7
--- /dev/null
+++ b/ci/scripts/security_audit.sh
@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+# Audits the root `Cargo.lock` with `cargo audit`, the same way the
+# "Security audit" GitHub workflow does.
+
+set -euo pipefail
+
+SCRIPT_NAME="$(basename "${BASH_SOURCE[0]}")"
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ROOT_DIR="$(cd "${SCRIPT_DIR}/../.." && pwd)"
+
+if ! command -v cargo-audit &> /dev/null; then
+  echo "[${SCRIPT_NAME}] cargo-audit is required. Install it with: cargo install cargo-audit --locked" >&2
+  exit 1
+fi
+
+# RUSTSEC-2026-0194 and RUSTSEC-2026-0195 are in quick-xml, reached through
+# object_store. Remove them once object_store upgrades to quick-xml >= 0.41.0.
+# https://github.com/apache/datafusion/issues/23297
+IGNORED_ADVISORIES=(
+  RUSTSEC-2026-0194
+  RUSTSEC-2026-0195
+)
+
+IGNORE_ARGS=()
+for advisory in "${IGNORED_ADVISORIES[@]}"; do
+  IGNORE_ARGS+=(--ignore "${advisory}")
+done
+
+cd "${ROOT_DIR}"
+
+echo "[${SCRIPT_NAME}] \`cargo audit ${IGNORE_ARGS[*]}\`"
+# The guarded expansion keeps `set -u` happy on bash 3.2 (macOS) if the list is empty.
+cargo audit ${IGNORE_ARGS[@]+"${IGNORE_ARGS[@]}"}
diff --git a/dev/rust_lint.sh b/dev/rust_lint.sh
index 6f185d2348..5862302d25 100755
--- a/dev/rust_lint.sh
+++ b/dev/rust_lint.sh
@@ -112,6 +112,7 @@ ensure_tool "taplo" "cargo install taplo-cli --locked"
 ensure_tool "hawkeye" "cargo install hawkeye --locked"
 ensure_tool "typos" "cargo install typos-cli --locked"
 ensure_tool "lychee" "cargo install lychee --locked --version ${LYCHEE_VERSION}"
+ensure_tool "cargo-audit" "cargo install cargo-audit --locked"
 
 run_step() {
   local name="$1"
@@ -133,6 +134,7 @@ declare -a READONLY_STEPS=(
   "ci/scripts/check_no_cargo_install_in_workflows.sh|false"
   "ci/scripts/check_asf_yaml_status_checks.py|false"
   "ci/scripts/markdown_link_check.sh|false"
+  "ci/scripts/security_audit.sh|false"
   "ci/scripts/rust_docs.sh|false"
 )
 
diff --git a/docs/source/contributor-guide/testing.md b/docs/source/contributor-guide/testing.md
index dc4430ebf4..e50e0942d0 100644
--- a/docs/source/contributor-guide/testing.md
+++ b/docs/source/contributor-guide/testing.md
@@ -239,6 +239,21 @@ uv run python3 ci/scripts/check_asf_yaml_status_checks.py
 [pyyaml]: https://pypi.org/project/PyYAML/
 [uv]: https://docs.astral.sh/uv/
 
+## Security Audit
+
+`ci/scripts/security_audit.sh` runs `cargo audit` on the root `Cargo.lock` with
+the advisory exceptions that CI uses. `./dev/rust_lint.sh` runs it and installs
+[cargo-audit] if it is missing. To run the audit on its own:
+
+```shell
+./ci/scripts/security_audit.sh
+```
+
+The audit fetches the RustSec advisory database. A new advisory or a different
+`cargo-audit` version can change the result without any change to the repository.
+
+[cargo-audit]: https://github.com/rustsec/rustsec/blob/main/cargo-audit/README.md
+
 ## Benchmarks
 
 ### Criterion Benchmarks


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@datafusion.apache.org
For additional commands, e-mail: commits-help@datafusion.apache.org