ci: modernize Actions, add cargo-deny gate, clear baseline lints

.github/workflows/security.yml

@@ -0,0 +1,22 @@
+name: Security audit
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  schedule:
+    # Re-run weekly so newly-published advisories are caught even without a push.
+    - cron: "0 6 * * 1"
+
+permissions:
+  contents: read
+
+jobs:
+  cargo-deny:
+    name: cargo-deny (advisories, bans, sources)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: EmbarkStudios/cargo-deny-action@34899fc7ba81ca6268d5947a7a16b4649013fea1 # v2.0.14
+        with:
+          command: check advisories bans sources

.github/workflows/test.yml

@@ -8,30 +8,32 @@ jobs:
   clippy:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v1
-      - uses: actions-rs/toolchain@v1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:
-            components: clippy
-            override: true
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9  # v1
+        with:
+          toolchain: stable
+          components: clippy
+      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4  # v2.9.1
       - name: Install dependencies
         run: sudo apt install -y openssl libkrb5-dev
-      - uses: actions-rs/clippy-check@v1
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          args: --features=all
+      - name: Clippy
+        run: cargo clippy --features=all -- -D warnings
 
   format:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v2
-      - uses: actions-rs/toolchain@v1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:
-          components: rustfmt
-          override: true
-      - uses: mbrobbel/rustfmt-check@master
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9  # v1
         with:
-          token: ${{ secrets.GITHUB_TOKEN }}
+          toolchain: stable
+          components: rustfmt
+      - name: Rustfmt
+        run: cargo fmt --check
 
   cargo-test-linux:
     runs-on: ubuntu-latest
@@ -57,20 +59,27 @@ jobs:
       RUSTFLAGS: "-Dwarnings"
 
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
 
-      - uses: actions-rs/toolchain@v1
+      - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9  # v1
+        with:
+          toolchain: stable
 
-      - uses: actions/cache@v2
+      - name: Compute cache key
+        shell: bash
+        run: |
+          key="${{ matrix.features }}"
+          key="${key//,/+}"
+          echo "RUST_CACHE_KEY=$key" >> "$GITHUB_ENV"
+
+      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4  # v2.9.1
         with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            target
-          key: ${{ runner.os }}-cargo-${{ matrix.features }}
+          shared-key: ${{ env.RUST_CACHE_KEY }}
 
       - name: Start SQL Server ${{matrix.database}}
-        run: DOCKER_BUILDKIT=1 docker-compose -f docker-compose.yml up -d mssql-${{matrix.database}}
+        run: DOCKER_BUILDKIT=1 docker compose -f docker-compose.yml up -d mssql-${{matrix.database}}
 
       - name: Install dependencies
         run: sudo apt install -y openssl libkrb5-dev
@@ -96,41 +105,39 @@ jobs:
       TIBERIUS_TEST_CONNECTION_STRING: "server=tcp:127.0.0.1,1433;IntegratedSecurity=true;TrustServerCertificate=true"
 
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
+
+      - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9  # v1
+        with:
+          toolchain: stable
 
-      - uses: actions-rs/toolchain@v1
+      - name: Compute cache key
+        shell: bash
+        run: |
+          key="${{ matrix.features }}"
+          key="${key//,/+}"
+          echo "RUST_CACHE_KEY=$key" >> "$GITHUB_ENV"
+
+      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4  # v2.9.1
+        with:
+          shared-key: ${{ env.RUST_CACHE_KEY }}
 
       - name: Set required PowerShell modules
         id: psmodulecache
-        uses: potatoqualitee/psmodulecache@v1
+        uses: potatoqualitee/psmodulecache@ee5e9494714abf56f6efbfa51527b2aec5c761b8  # v6.2.1
         with:
           modules-to-cache: SqlServer
 
-      - name: Setup PowerShell module cache
-        id: cacher
-        uses: actions/cache@v2
-        with:
-            path: ${{ steps.psmodulecache.outputs.modulepath }}
-            key: ${{ steps.psmodulecache.outputs.keygen }}
-
       - name: Setup Chocolatey download cache
         id: chococache
-        uses: actions/cache@v2
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae  # v5.0.5
         with:
           path: C:\Users\runneradmin\AppData\Local\Temp\chocolatey\
           key: chocolatey-install
 
-      - name: Setup Cargo build cache
-        uses: actions/cache@v2
-        with:
-          path: |
-            C:\Users\runneradmin\.cargo\registry
-            C:\Users\runneradmin\.cargo\git
-            target
-          key: ${{ runner.os }}-cargo
-
       - name: Install required PowerShell modules
-        if: steps.cacher.outputs.cache-hit != 'true'
         shell: powershell
         run: |
             Set-PSRepository PSGallery -InstallationPolicy Trusted
@@ -189,7 +196,7 @@ jobs:
         run: cargo test ${{matrix.features}}
 
   cargo-test-macos:
-    runs-on: macos-12
+    runs-on: macos-26-intel
 
     strategy:
       fail-fast: false
@@ -204,14 +211,32 @@ jobs:
       TIBERIUS_TEST_CONNECTION_STRING: "server=tcp:localhost,1433;user=SA;password=<YourStrong@Passw0rd>;TrustServerCertificate=true"
 
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
+
+      - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9  # v1
+        with:
+          toolchain: stable
+
+      - name: Compute cache key
+        shell: bash
+        run: |
+          key="${{ matrix.features }}"
+          key="${key//,/+}"
+          echo "RUST_CACHE_KEY=$key" >> "$GITHUB_ENV"
+
+      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4  # v2.9.1
+        with:
+          shared-key: ${{ env.RUST_CACHE_KEY }}
 
-      - uses: actions-rs/toolchain@v1
+      - uses: docker/setup-docker-action@b2189fbf2a6592b51fee7cdd93ee2bfaeba733db  # v5.1.0
 
-      - uses: docker-practice/actions-setup-docker@master
+      - name: Install docker compose plugin
+        run: brew install docker-compose
 
       - name: Start SQL Server ${{matrix.database}}
-        run: DOCKER_BUILDKIT=1 docker-compose -f docker-compose.yml up -d mssql-${{matrix.database}}
+        run: DOCKER_BUILDKIT=1 docker compose -f docker-compose.yml up -d mssql-${{matrix.database}}
 
       - name: Run tests
         run: cargo test ${{matrix.features}}

Cargo.toml

@@ -160,13 +160,13 @@ path = "./runtimes-macro"
 [dev-dependencies]
 names = "0.14"
 anyhow = "1"
-env_logger = "0.9"
+env_logger = "0.11"
 azure_identity = "0.20.0"
 oauth2 = "5.0"
 url = "2.2.2"
 reqwest = "0.12"
 paste = "1.0"
-indicatif = "0.17"
+indicatif = "0.18"
 chrono = "0.4.38"
 indoc = "1.0.7"
 

deny.toml

@@ -0,0 +1,37 @@
+# cargo-deny configuration — supply-chain / advisory gate for tiberius.
+#
+# Run locally with:  cargo deny check advisories bans sources
+# CI runs the same via .github/workflows/security.yml.
+#
+# Policy: any security *vulnerability* or *yanked* crate in the actually-built
+# dependency graph fails the build. The `ignore` list below contains only
+# advisories that are provably NOT part of the shipped library — they come from
+# dev-dependencies (tests/examples) or from opt-in, non-default features — so
+# they cannot affect a downstream user of the default crate. Each entry is
+# justified; revisit whenever the upstream tooling gains a maintained successor.
+
+[advisories]
+yanked = "deny"
+ignore = [
+    # async-std is discontinued upstream. In tiberius it is reachable ONLY through
+    # the opt-in `sql-browser-async-std` feature (and dev-deps); it is not part of
+    # the default build. Tracked for migration to smol/tokio.
+    { id = "RUSTSEC-2025-0052", reason = "async-std: opt-in `sql-browser-async-std` feature + dev-deps only; not in the default shipped graph" },
+
+    # The following are ALL dev-dependency-only (test harness + the aad-auth
+    # example) and are never compiled into the published library.
+    { id = "RUSTSEC-2024-0375", reason = "atty: dev-dependency only (via `names` -> clap 3); not shipped" },
+    { id = "RUSTSEC-2024-0370", reason = "proc-macro-error: dev-dependency only (via `names` -> clap 3); not shipped" },
+    { id = "RUSTSEC-2024-0384", reason = "instant: transitive dev-dependency only; not shipped" },
+    { id = "RUSTSEC-2024-0436", reason = "paste: dev/test only (tests/bulk.rs + azure_identity example); not shipped" },
+    { id = "RUSTSEC-2026-0174", reason = "http-types: dev-only via azure_identity in the aad-auth example; not shipped" },
+]
+
+[bans]
+multiple-versions = "warn"
+wildcards = "allow"
+
+[sources]
+unknown-registry = "deny"
+unknown-git = "deny"
+allow-registry = ["https://github.com/rust-lang/crates.io-index"]

docker-compose.yml

@@ -1,6 +1,7 @@
 version: "3"
 services:
   mssql-2022:
+    platform: linux/amd64
     build:
       context: docker/
       dockerfile: docker-mssql-2022.dockerfile
@@ -12,6 +13,7 @@ services:
       - "1433:1433"
 
   mssql-2019:
+    platform: linux/amd64
     build:
       context: docker/
       dockerfile: docker-mssql-2019.dockerfile
@@ -23,6 +25,7 @@ services:
       - "1433:1433"
 
   mssql-2017:
+    platform: linux/amd64
     build:
       context: docker/
       dockerfile: docker-mssql-2017.dockerfile
@@ -34,6 +37,7 @@ services:
       - "1433:1433"
 
   mssql-azure-sql-edge:
+    platform: linux/amd64
     build:
       context: docker/
       dockerfile: docker-azure-sql-edge.dockerfile

docker/certs/customCA.srl

@@ -1 +1 @@
-0DAEECC45C07F5E06E0DD1B05115C3CFD1A46D9C
+0DAEECC45C07F5E06E0DD1B05115C3CFD1A46D9D

docker/certs/generate-signed-cert.sh

@@ -5,8 +5,10 @@ set -o pipefail
 
 # Skript creates a custom-signed certificate
 # Parameter1 = name of the cert
+# Parameter2 = validity in days (default 1825)
 
 CERT_KEY_NAME=$1
+CERT_DAYS=${2:-1825}
 CERT_FILE=$CERT_KEY_NAME.crt
 
 export CERT_CN=$CERT_KEY_NAME
@@ -32,7 +34,7 @@ openssl x509 -req \
   -CAserial customCA.srl \
   -out $CERT_FILE \
   -passin file:passphrase.txt \
-  -days 200
+  -days $CERT_DAYS
 
 echo Generating PEM format
 openssl rsa -in ${CERT_KEY_NAME}.key -out ${CERT_KEY_NAME}-nopassword.key