From 54dee3fe18c7e3e959ed88e20d3df2846a2c4070 Mon Sep 17 00:00:00 2001 From: Albert Hui Date: Wed, 19 Aug 2026 06:43:30 +0000 Subject: [PATCH] chore(ci): delete the unsafe audit that cannot fail - run: cargo geiger 2>&1 || true continue-on-error: true `|| true` on the step and `continue-on-error` on the job: this check has never been capable of reporting anything. It is also a SIBLING of the shared-workflow call rather than a job inside it, so `ci / All checks` never reached it and branch protection never required it. Eighteen repos carried a byte-identical copy. Deleting rather than fixing, because a working exit code would not help. Where `unsafe_code = "forbid"` is in force, `unsafe` is a compile error, so a job asserting its absence still could not fail -- the same defect with a healthier appearance. The real control is now in the shared workflow: `Unsafe lint audit` asserts that every workspace member EFFECTIVELY forbids or denies `unsafe_code`, which is the part the compiler cannot tell you. A member with no `[lints]` table does not inherit workspace lints (inheritance is opt-in via `[lints] workspace = true`), and a member with its own `[lints]` table replaces inheritance rather than extending it. Either way it compiles with `unsafe` permitted while the workspace root still reads compliant. That check lives inside the gate, is required by branch protection, and found five unprotected published crates on its first run. A check that cannot fail is worse than no check: it reads as coverage that does not exist. --- .github/workflows/ci.yml | 11 ----------- 1 file changed, 11 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 5e4940f..fd55e04 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -70,14 +70,3 @@ jobs: echo "$list" | grep -q '^LICENSE' || { echo "::error::$p does not package a LICENSE file"; exit 1; } echo "✓ $p packages README.md + LICENSE" done - - geiger: - name: Unsafe Audit (cargo-geiger) - runs-on: ubuntu-latest - continue-on-error: true - steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable - - uses: Swatinem/rust-cache@9bdad043e88c75890e36ad3bbc8d27f0090dd609 # v2.7.8 - - run: cargo install cargo-geiger --locked - - run: cargo geiger 2>&1 || true