CtrlK
BlogDocsLog inGet started
Tessl Logo

testland/cargo-audit-rust

Configures and runs cargo-audit against the RustSec Advisory Database for Rust projects; covers `cargo audit` (vulnerability scan), `cargo audit fix` (automated dependency updates), `--deny unmaintained|unsound|yanked|warnings` exit-code control, `audit.toml` per-advisory suppression with mandatory `expires` + `reason`, SARIF output for GitHub Code Scanning upload, and `rustsec/audit-check` GitHub Actions integration. Use when the codebase has a Cargo.lock and needs Rust-specific SCA beyond what the multi-ecosystem npm-pip-maven-audit wrapper provides.

75

Quality

94%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Passed

No findings from the security scan

Overview
Quality
Evals
Security
Files

cargo-audit-config-and-ci.mdreferences/

cargo-audit config, binary auditing, and CI

Deep reference for the cargo-audit-rust SKILL.md. SKILL.md keeps install, the basic scan, --deny semantics, output formats, cargo audit fix, and the minimal suppression template; this file holds the full .cargo/audit.toml schema, binary auditing, and the GitHub Actions wiring.

Full .cargo/audit.toml schema

Per the audit.toml example:

# .cargo/audit.toml

[advisories]
# Advisory IDs to suppress - each MUST have a reason and expiry tracked in a
# companion comment or issue tracker entry
ignore = ["RUSTSEC-2024-0001"]

# Informational categories to surface as warnings (not hard failures)
informational_warnings = ["unmaintained", "unsound"]

# Minimum CVSS severity to report: "none" | "low" | "medium" | "high" | "critical"
severity_threshold = "medium"

[output]
# "terminal" | "json" | "sarif"
format = "terminal"

# Hard-fail categories (mirrors --deny flags)
deny = ["warnings"]

# Show inverse dependency trees alongside each finding
show_tree = true

[database]
# Skip remote fetch (for offline / air-gapped builds)
fetch = false

# Allow an advisory DB that has not been updated recently
stale = false

Binary auditing

For auditing compiled binaries (e.g. checking a deployed artifact without source access), install the companion crate and audit the binary (rustsec-readme):

# Compile with embedded dependency metadata
cargo install cargo-auditable
cargo auditable build --release

# Audit the compiled binary
cargo audit bin target/release/my-app

Binary auditing works best when the binary was compiled with cargo-auditable, which embeds Cargo.lock metadata into the ELF/Mach-O/PE section. Binaries without embedded metadata cannot be audited.

GitHub Actions CI integration

Use the official rustsec/audit-check action, which wraps cargo audit, creates check runs, and (for scheduled workflows) opens GitHub Issues for each advisory (audit-check README):

name: Security audit
on:
  push:
    paths:
      - '**/Cargo.toml'
      - '**/Cargo.lock'
  schedule:
    - cron: '0 0 * * *'

jobs:
  security_audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: rustsec/audit-check@v2.0.0
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          # Optional: comma-separated advisory IDs to suppress
          # ignore: "RUSTSEC-2024-0001,RUSTSEC-2024-0002"
          # Optional: subdirectory with Cargo.toml
          # working-directory: crates/my-crate

CI gate behavior (audit-check-action):

  • Pass: no security advisories found (informational advisories do not fail the check).
  • Fail: any security advisory found; the check run is marked failed.
  • Scheduled runs create a GitHub Issue per advisory for tracking.

For SARIF upload alongside the action:

- name: Run cargo audit (SARIF)
        run: cargo audit --format sarif > cargo-audit.sarif || true
      - uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: cargo-audit.sarif

references

cargo-audit-config-and-ci.md

SKILL.md

tile.json