fix(ci): fix YAML syntax error — move audit python script to .gitlab/check-audit.py

.gitlab-ci.yml

@@ -240,44 +240,7 @@ cargo-audit:
   before_script: []
   script:
     - cargo install cargo-audit --locked -q
-    - |
+    - cargo audit --json 2>/dev/null | python3 .gitlab/check-audit.py
-      # --json + python summary: avoids 4MB log overflow from full dependency trees
-      cargo audit --json 2>/dev/null | python3 -c "
-import sys, json
-data = json.load(sys.stdin)
-ignore = {
-  # wasmtime: fix requires rustc 1.91.0+, toolchain pinned to 1.88.0
-  'RUSTSEC-2026-0006','RUSTSEC-2026-0020','RUSTSEC-2026-0021',
-  'RUSTSEC-2026-0085','RUSTSEC-2026-0086','RUSTSEC-2026-0087',
-  'RUSTSEC-2026-0088','RUSTSEC-2026-0089','RUSTSEC-2026-0091',
-  'RUSTSEC-2026-0092','RUSTSEC-2026-0093','RUSTSEC-2026-0094',
-  'RUSTSEC-2026-0095','RUSTSEC-2026-0096',
-  # rsa: no fixed version available
-  'RUSTSEC-2023-0071',
-  # tracing-subscriber 0.2.x: pulled by arkworks internals, not our direct dep
-  'RUSTSEC-2025-0055',
-  # rustls-webpki: transitive via kube-client, upgrade requires kube ecosystem bump
-  'RUSTSEC-2026-0098','RUSTSEC-2026-0099',
-  # rand: unsound only with custom logger calling rand::rng() during init
-  'RUSTSEC-2026-0097',
-  # lru: Stacked Borrows issue in IterMut, no user-facing exploit path
-  'RUSTSEC-2026-0002',
-}
-vulns = data.get('vulnerabilities', {}).get('list', [])
-fail = False
-for v in vulns:
-    adv = v.get('advisory', {})
-    pkg = v.get('package', {})
-    aid = adv.get('id', '')
-    if aid in ignore:
-        print(f'  [ignored] {aid} in {pkg.get(\"name\",\"?\")} {pkg.get(\"version\",\"?\")}')
-    else:
-        print(f'  [FAIL]    {aid} in {pkg.get(\"name\",\"?\")} {pkg.get(\"version\",\"?\")} — {adv.get(\"title\",\"?\")}')
-        fail = True
-if fail:
-    sys.exit(1)
-print(f'audit ok — {len(vulns)} advisories checked, all ignored or none found')
-"
   allow_failure: false
   rules:
     - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH

.gitlab/check-audit.py

@@ -0,0 +1,50 @@
+#!/usr/bin/env python3
+"""Parse cargo audit --json output and fail only on unignored vulnerabilities.
+
+Avoids the 4MB log overflow that happens when cargo audit prints full
+dependency trees for every advisory.
+"""
+import sys
+import json
+
+IGNORE = {
+    # wasmtime: fix requires rustc 1.91.0+, toolchain pinned to 1.88.0.
+    # We do NOT use Winch backend, Component Model, or 64-bit tables.
+    "RUSTSEC-2026-0006", "RUSTSEC-2026-0020", "RUSTSEC-2026-0021",
+    "RUSTSEC-2026-0085", "RUSTSEC-2026-0086", "RUSTSEC-2026-0087",
+    "RUSTSEC-2026-0088", "RUSTSEC-2026-0089", "RUSTSEC-2026-0091",
+    "RUSTSEC-2026-0092", "RUSTSEC-2026-0093", "RUSTSEC-2026-0094",
+    "RUSTSEC-2026-0095", "RUSTSEC-2026-0096",
+    # rsa: no fixed version available (Marvin Attack)
+    "RUSTSEC-2023-0071",
+    # tracing-subscriber 0.2.x: pulled by arkworks internals only
+    "RUSTSEC-2025-0055",
+    # rustls-webpki: transitive via kube-client, upgrade needs kube ecosystem bump
+    "RUSTSEC-2026-0098", "RUSTSEC-2026-0099",
+    # rand: unsound only with custom logger calling rand::rng() during init
+    "RUSTSEC-2026-0097",
+    # lru: Stacked Borrows in IterMut, no user-facing exploit path
+    "RUSTSEC-2026-0002",
+}
+
+data = json.load(sys.stdin)
+vulns = data.get("vulnerabilities", {}).get("list", [])
+
+fail = False
+for v in vulns:
+    adv = v.get("advisory", {})
+    pkg = v.get("package", {})
+    aid = adv.get("id", "")
+    name = pkg.get("name", "?")
+    ver = pkg.get("version", "?")
+    title = adv.get("title", "?")
+    if aid in IGNORE:
+        print(f"  [ignored] {aid}  {name} {ver}")
+    else:
+        print(f"  [FAIL]    {aid}  {name} {ver}  —  {title}")
+        fail = True
+
+if fail:
+    sys.exit(1)
+
+print(f"audit ok — {len(vulns)} advisories checked")