fix(ci): actually run the advisories check, and clear the dead ignores (REQ-347)

[avrabe]

The Cargo Deny job ran cargo deny check bans licenses sources. The advisories check was not run at all — so deny.toml's entire [advisories] section, every reasoned RUSTSEC ignore, was configuration the job never consulted. cargo-audit exists but sits outside CI Gate's needs, so a tree failing cargo deny check advisories merged clean.

It fails today: three unmaintained crates, none ignored.

Change

Now runs advisories bans licenses sources, renamed to Cargo Deny (advisories, licenses, bans, sources) — a job whose name omits what it checks is the same defect one level up. deny is in CI Gate's needs, so advisory checking is now blocking.

The version skew was the actual risk. CI pinned 0.16.4; the policy was verified on 0.20.2, which treats unmaintained as an error by default. Adding the check while pinning an untested version is how a gate passes vacuously — bumped to 0.20.2.

Root cause is one chain: gluesql-core → im → sized-chunks → bitmaps, via the default-on sql feature. Accepted with the reason in deny.toml; --no-default-features (REQ-202) excludes it entirely.

Two things found doing it

The RUSTSEC ids were guessed and wrong. cargo-deny answered advisory-not-encountered while the errors persisted; the real ids came from the tool: 2026-0247/0248/0251. An invented id silences nothing while appearing to — the failure this change is about.

12 of the 16 existing ignores were dead. RUSTSEC-2026-0085…0096 and 0103 matched nothing — resolved by the wasmtime 44→45 bump and salsa moving off thin-vec. Their comments still read "upgrade to wasmtime ≥43 when available" and "remove when salsa ≥0.27 lands": instructions for work already done. Three-quarters of the section recorded history, not decisions. Removed; four live entries remain, each with a current reason.

Verification

cargo deny check advisories                       exit 0   (0 errors, 0 stale warnings)
cargo deny check advisories bans licenses sources exit 0   advisories ok, bans ok, licenses ok, sources ok

Negative control: removing the im ignore → exit 1 with the unmaintained error; restoring → exit 0.

gate	exit
fmt / clippy -D warnings (1.97.0)	0 / 0
cargo test --workspace	0 — 2368 passed
cargo test -p rivet-cli --test cli_commands	0 — 213 passed
validate / docs check / yamllint / diagnose_test.sh	0

Also files REQ-351 — the probe has fired 95 times, tripping nightly on the 16-shard matrix against 4 lean-mem runners. #933 confirms REQ-342 and REQ-343 working in production: the alert now says the runner list could not be read and claims no cause, where the old code would have announced the pool OFFLINE while it was online=12 busy=11.

Fixes: REQ-347

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[github-actions]

📐 Rivet artifact delta

Change	Count
Added	1
Removed	0
Modified	1
Downstream impacted (depth ≤ 5)	0

Graph

graph LR
  REQ_347["REQ-347"]:::modified
  REQ_351["REQ-351"]:::added
  classDef added fill:#d4edda,stroke:#28a745,color:#155724
  classDef removed fill:#f8d7da,stroke:#dc3545,color:#721c24
  classDef modified fill:#fff3cd,stroke:#ffc107,color:#856404
  classDef overflow fill:#e2e3e5,stroke:#6c757d,color:#495057,stroke-dasharray: 3 3

Loading

Added

• REQ-351

Modified

ID	Changes
REQ-347

📎 Full HTML dashboard attached as workflow artifact rivet-delta-pr-934 — download from the workflow run.

_{Posted by rivet-delta workflow. The graph shows only changed artifacts; open the HTML dashboard (above) for full context.}