#60 Harden supply chain, CI, and remote IPC scope

[Anonymous]

Originally created by: kristofferR

Quick-win hardening from the July 2026 codebase assessment (epic: see [#59]).

• Pin tauri-plugin-mcp to a rev — it was an unpinned git dependency (Ref [#49])
• cargo audit CI job (weekly schedule + every push/PR) so new RUSTSEC advisories surface even without commits (Ref [#49])
• Dependabot for cargo, github-actions, and npm, with minor/patch bumps grouped (Ref [#49])
• Release gate: release.yml now runs fmt/clippy/test/node --check in a check job the build matrix needs — a tag on an unverified commit no longer ships to 6 targets. Runs parallel to prepare_release, so no added wall-clock (Ref [#49])
• Tighter remote IPC scope: dropped meta.com/oculus.com from capabilities/default.json. Any listed origin's own page scripts can call the allowed IPC (opener:allow-open-url etc.), and those hosts only appear during Meta-account login redirects where the injected features fail soft (Ref [#50])
• dark-light 1.x → 2.x: fallible detect() API, XDG-portal-based detection on Linux (Ref [#58])

Verified: cargo fmt / clippy -D warnings / cargo test pass, cargo check --features mcp resolves against the pinned rev, actionlint clean on both workflows.

https://claude.ai/code/session_01Pqw8xaJrGLhgSo2YR68ov5

Summary by CodeRabbit

• New Features
• Added automated weekly security audits and scheduled dependency update PRs.
• Enhanced release validation with formatting, stricter linting, test runs, and script syntax checks.
• Bug Fixes
• Improved dark mode detection to correctly handle system theme detection results.
• Tightened remote origin allowlisting to narrow permitted connections.
• Chores
• Updated and pinned Rust dependencies for more consistent builds.
• Adjusted security audit configuration to ignore specific known advisories.

[Anonymous]

Originally posted by: kristofferR

@coderabbitai review

[Anonymous]

Originally posted by: coderabbitai[bot]

✅ Action performed

Review finished. > Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[Anonymous]

Originally posted by: coderabbitai[bot]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

**Configuration used**: Path: .coderabbit.yaml **Review profile**: ASSERTIVE **Plan**: Pro **Run ID**: `55c40547-12f9-40e5-9252-930f07ed5600`

📥 Commits

Reviewing files that changed from the base of the PR and between [9eb365] and 1fc2eadc299eeebbff54c690dd70dee24a81d98e.

📒 Files selected for processing (2)

* `.github/dependabot.yml` * `.github/workflows/release.yml`

---

📝 Walkthrough

## Walkthrough Adds cargo-audit configuration and a weekly CI audit job, introduces Dependabot scheduling for cargo/github-actions/bun, adds release workflow checks and gating, pins `tauri-plugin-mcp`, bumps `dark-light`, tightens the remote URL allowlist, and updates dark mode detection to handle a `Result`. ### Changes **CI, dependency, and security hardening** |Layer / File(s)|Summary| |---|---| |**cargo-audit configuration and CI job**
`.cargo/audit.toml`, `.github/workflows/ci.yml`|Ignores two RUSTSEC advisories with justification comments; adds a weekly-scheduled `audit` job running `cargo audit` against `src-tauri/Cargo.lock`.| |**Dependabot configuration**
`.github/dependabot.yml`|Enables weekly dependency updates for cargo (src-tauri, grouped minor/patch), github-actions, and bun.| |**Release workflow pre-build checks**
`.github/workflows/release.yml`|Adds a `check` job (fmt, clippy, tests, node --check) and gates the `build` job on both `check` and `prepare_release`.| |**Dependency pinning and version bump**
`src-tauri/Cargo.toml`|Bumps `dark-light` to v2 and pins `tauri-plugin-mcp` to a specific git revision.| |**Capabilities remote URL allowlist tightening**
`src-tauri/capabilities/default.json`|Removes `meta.com`/`oculus.com` entries from `remote.urls` and clarifies the description of allowed origins.| |**Dark mode detection Result handling**
`src-tauri/src/lib.rs`|Updates `is_dark` to match `dark_light::detect()` as a `Result`, checking for `Ok(Mode::Dark)`.| **Estimated code review effort:** 2 (Simple) | ~12 minutes **Possibly related PRs** - [[kristofferR/Carrier#2](https://github.com/kristofferR/Carrier/issues/2)](https://github.com/kristofferR/Carrier/pull/2): Related `is_dark`/theme handling work in `src-tauri/src/lib.rs`.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

| Check name | Status | Explanation | | :------------------------: | :------- | :---------------------------------------------------------------------------------------------------------------------------- | | Description Check | ✅ Passed | Check skipped - CodeRabbit’s high-level summary is enabled. | | Title check | ✅ Passed | The title clearly matches the main themes of the changeset: supply chain hardening, CI updates, and tighter remote IPC scope. | | Docstring Coverage | ✅ Passed | No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. | | Linked Issues check | ✅ Passed | Check skipped because no linked issues were found for this pull request. | | Out of Scope Changes check | ✅ Passed | Check skipped because no linked issues were found for this pull request. |

✨ Finishing Touches

🧪 Generate unit tests (beta)

- [ ] Create PR with unit tests - [ ] Commit unit tests in branch `chore/supply-chain-hardening`

⚔️ Resolve merge conflicts

- [ ] Resolve merge conflict in branch `chore/supply-chain-hardening`

---

_{Comment @coderabbitai help to get the list of available commands.}

[Anonymous]

Originally posted by: kristofferR

@coderabbitai review

[Anonymous]

Originally posted by: coderabbitai[bot]

✅ Action performed

Review finished. > Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[Anonymous]

Originally posted by: kristofferR

@coderabbitai review

[Anonymous]

Originally posted by: coderabbitai[bot]

✅ Action performed

Review finished. > Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[Anonymous]

Ticket changed by: kristofferR

• status: open --> closed