CI: valid YAML, pinned actions, fmt, cargo deny and npm audit

The old workflow was invalid YAML (unquoted ${{ }} in a flow mapping) and never ran.
deny.toml: allows BSL-1.0 (arboard's Windows deps) and CDLA-Permissive-2.0
(webpki-roots); ignores three unmaintained-crate notices for build-time proc-macros
(uniffi 0.28, glib-macros 0.18) that need upstream upgrades.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

.github/workflows/ci.yml

@@ -1,23 +1,75 @@
 name: ci
-on: [push, pull_request]
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  CARGO_TERM_COLOR: always
+
+# Sibling repos are checked out side by side under $GITHUB_WORKSPACE, as the relative path
+# dependencies expect (../kestrove-core). If the repos are private, add a fine-grained token with
+# read access to them as the CORE_READ_TOKEN secret; github.token can only read this repository.
+
 jobs:
   build:
     strategy:
-      matrix: { os: [ubuntu-22.04, windows-latest] }
+      fail-fast: false
+      matrix:
+        os: [ubuntu-22.04, windows-2025]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with: { path: kestrove-desktop }
+        with: { path: kestrove-desktop, persist-credentials: false }
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with: { repository: ${{ github.repository_owner }}/kestrove-core, path: kestrove-core, token: ${{ secrets.CORE_READ_TOKEN }} }
+        with:
+          repository: ${{ github.repository_owner }}/kestrove-core
+          path: kestrove-core
+          token: ${{ secrets.CORE_READ_TOKEN || github.token }}
+          persist-credentials: false
       - if: runner.os == 'Linux'
         run: sudo apt-get update && sudo apt-get install -y libwebkit2gtk-4.1-dev libayatana-appindicator3-dev librsvg2-dev patchelf libxdo-dev
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master, 2026-10
-      - uses: actions/setup-node@v4
+        with: { toolchain: stable, components: "clippy, rustfmt" }
-        with: { node-version: 22 }
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
-      - run: npm ci && npm run build
+        with: { workspaces: kestrove-desktop/src-tauri }
-        working-directory: kestrove-desktop
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
-      - run: cargo clippy --all-targets -- -D warnings
+        with:
-        working-directory: kestrove-desktop/src-tauri
+          node-version: 24
-      - run: cargo test
+          cache: npm
-        working-directory: kestrove-desktop/src-tauri
+          cache-dependency-path: kestrove-desktop/package-lock.json
+      # `npm run build` type-checks (tsc --noEmit) and writes dist/, which tauri::generate_context! embeds.
+      - working-directory: kestrove-desktop
+        run: |
+          npm ci
+          npm run build
+      - working-directory: kestrove-desktop/src-tauri
+        run: |
+          cargo fmt --all --check
+          cargo clippy --all-targets -- -D warnings
+          cargo test
+
+  deny:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with: { path: kestrove-desktop, persist-credentials: false }
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          repository: ${{ github.repository_owner }}/kestrove-core
+          path: kestrove-core
+          token: ${{ secrets.CORE_READ_TOKEN || github.token }}
+          persist-credentials: false
+      - uses: EmbarkStudios/cargo-deny-action@3c6349835b2b7b196a839186cb8b78e02f7b5f25 # v2.1.1
+        with: { command: check, manifest-path: kestrove-desktop/src-tauri/Cargo.toml }
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with: { node-version: 24 }
+      - working-directory: kestrove-desktop
+        run: npm audit --omit=dev

src-tauri/deny.toml

@@ -0,0 +1,31 @@
+# cargo deny check — enforces docs/06 §5 (no GPL in shipped apps) and advisories. Mirrors kestrove-core/deny.toml.
+# Not run by `npm audit`: covers only the Rust side (src-tauri).
+[advisories]
+version = 2
+yanked = "deny"
+ignore = [
+  # Unmaintained notices (no known vulnerability) for build-time proc-macro crates we can't replace
+  # without upgrading upstream: uniffi 0.28 (through kv-ffi) and gtk-rs glib-macros 0.18 (Tauri on Linux).
+  { id = "RUSTSEC-2025-0141", reason = "bincode 1.x via uniffi_macros 0.28 (build-time)" },
+  { id = "RUSTSEC-2024-0436", reason = "paste via uniffi 0.28 (proc-macro)" },
+  { id = "RUSTSEC-2024-0370", reason = "proc-macro-error via glib-macros 0.18 / Tauri gtk stack (proc-macro)" },
+]
+
+[licenses]
+version = 2
+allow = ["MIT", "Apache-2.0", "Apache-2.0 WITH LLVM-exception", "BSD-2-Clause", "BSD-3-Clause", "ISC", "Unicode-3.0", "Unicode-DFS-2016", "Zlib", "CC0-1.0", "MPL-2.0",
+  # clipboard-win / error-code (arboard on Windows): Boost Software License, permissive.
+  "BSL-1.0",
+  # webpki-roots (Mozilla's CA bundle, via kv-ffi's TLS): permissive data license.
+  "CDLA-Permissive-2.0"]
+confidence-threshold = 0.9
+
+[bans]
+multiple-versions = "warn"
+wildcards = "deny"
+# kv-ffi is a path dependency on ../../kestrove-core without a version; this crate is never published.
+allow-wildcard-paths = true
+
+[sources]
+unknown-registry = "deny"
+unknown-git = "deny"