Add renovate best practices, cargo vet and audit

.gitlab-ci.yml

@@ -1,5 +1,10 @@
 image: "rust:latest"
 
+stages:
+  - build
+  - test
+  - audit
+
 variables:
   # move cargo data into the project directory so it can be cached
   CARGO_HOME: ${CI_PROJECT_DIR}/.cargo
@@ -21,12 +26,31 @@ default:
       - target
 
 cargo:fmt:
+  stage: build
   script:
     - rustc --version && cargo --version  # Print version info for debugging
     - rustup component add rustfmt
     - cargo fmt --check
 
+cargo:clippy:
+  stage: build
+  script:
+    - rustup component add clippy
+    - cargo clippy --all-features --workspace -- -D warnings
+
+test:lox-unit:
+  stage: test
+  # this job is only run if clippy and fmt pass
+  script:
+    - cargo test --workspace --verbose
+  artifacts:
+    when: always
+
 cargo:audit:
+  stage: audit
+  # this job only runs in the main branch
+  rules:
+  - if: $CI_COMMIT_BRANCH == "main"
   # This can start to fail even when our code doesn't change.
   # Usually the new advisory is not a huge concern.
   # Run it last, separately, so if we think we may want to merge anyway,
@@ -38,15 +62,22 @@ cargo:audit:
     paths:
       - cache
 
-cargo:clippy:
+cargo:vet:
+  stage: audit
+  # This will likely fail but will give us an idea of
+  # changes that might cause issues for the browser team
+  # Usually the new advisory is not a huge concern.
+  # Run it last, separately, so if we think we may want to merge anyway,
+  # all the other tests will have been run.
+  # this job only runs in the main branch
+  rules:
+  - if: $CI_COMMIT_BRANCH == "main"
   script:
-    - rustup component add clippy
-    - cargo clippy --all-features --workspace -- -D warnings
-
-
-test:lox-unit:
-    # this job is only run if clippy passes
-   script:
-     - cargo test --workspace --verbose
-   artifacts:
-     when: always
+    - ./maint/rust-maint-common/via-cargo-install-in-ci cargo-vet
+    # Entities that have audits to import
+    - cargo vet import mozilla
+    - cargo vet import isrg
+    - cargo vet check
+  cache:
+    paths:
+      - cache

renovate.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": [
-    "config:base"
+    "config:best-practices"
   ],
   "ignoreDeps": ["lox-zkp", "thiserror", "chrono", "base64"]
 }