Skip to content

Restructure into a cargo workspace and refresh GitHub Actions - #2

Merged
senamakel merged 24 commits into
mainfrom
restructure-crates
Aug 21, 2026
Merged

Restructure into a cargo workspace and refresh GitHub Actions#2
senamakel merged 24 commits into
mainfrom
restructure-crates

chore(deny): allow wildcard paths for unpublished workspace crates

3dc4594
Select commit
Loading
Failed to load commit list.
TinySweeper / tinysweeper/security completed Aug 21, 2026 in 0s

2 findings

Reviewed 0 files; 0 findings. 25 files could not be reviewed: .github/workflows/release.yml, .github/workflows/ci.yml, AGENTS.md, Cargo.toml, crates/template-bus/Cargo.toml, crates/template/Cargo.toml, .claude/settings.json, .github/scripts/check-file-coverage.sh, crates/template-bus/src/greeting/mod.rs, crates/template-bus/src/greeting/types.rs, crates/template-bus/src/lib.rs, crates/template-bus/src/names/mod.rs, crates/template-bus/src/version/mod.rs, crates/template/examples/basic.rs, crates/template/examples/verify_github_release.rs, crates/template/examples/verify_module.rs, crates/template/src/greeting/mod.rs, crates/template/src/lib.rs, crates/template/src/tinybus_module/mod.rs, deny.toml, crates/template-bus/src/greeting/test.rs, crates/template-bus/src/names/test.rs, crates/template-bus/src/version/test.rs, crates/template/src/tinybus_module/test.rs, crates/template/tests/public_api.rs. 8 files were not security-reviewed: MODULE.md (prose or tabular data), README.md (prose or tabular data), crates/template-bus/README.md (prose or tabular data), crates/template/src/tinybus_module/README.md (prose or tabular data), docs/plans/example-retry-policy.md (prose or tabular data), and 3 more.

Finding Where
medium taiki-e/install-action is pinned to v2, which is mutable .github/workflows/ci.yml:35
medium taiki-e/install-action is pinned to v2, which is mutable .github/workflows/release.yml:48
![medium](https://img.shields.io/badge/medium-fbca04?style=flat-square) `taiki-e/install-action` is pinned to `v2`, which is mutable

.github/workflows/ci.yml:35 uncertain

[RULE] unpinned-action

A tag or branch can be repointed by whoever owns taiki-e, and the new code runs with this workflow's secrets. Pin to a full commit SHA and let Dependabot bump it.

![medium](https://img.shields.io/badge/medium-fbca04?style=flat-square) `taiki-e/install-action` is pinned to `v2`, which is mutable

.github/workflows/release.yml:48 uncertain

[RULE] unpinned-action

A tag or branch can be repointed by whoever owns taiki-e, and the new code runs with this workflow's secrets. Pin to a full commit SHA and let Dependabot bump it.

tinysweeper 0.1.0