Add Dependabot configuration and update Rust dependencies

[uurcan7]

This pull request updates dependencies and refactors certificate generation in the Rust codebase, while also modernizing the GitHub Actions workflows. The main goals are to keep dependencies up to date, improve compatibility with the latest APIs, and ensure CI stability.

Dependency Updates:

• Updated several Rust crate dependencies to their latest versions in Cargo.toml, including serde_json, base64, nix, and rcgen, to address potential security and compatibility issues.

Certificate Generation Refactor:

• Refactored ECDSA certificate generation in generate.rs and related tests to use the new KeyPair and self_signed API from rcgen, replacing the deprecated usage of the alg field and Certificate::from_params. [1] [2] [3] [4] [5]

CI/CD Workflow Modernization:

• Updated GitHub Actions workflow files to use the latest major versions of actions (e.g., actions/checkout@v7, actions/cache@v6, actions/upload-artifact@v7, actions/download-artifact@v8) to benefit from the latest features and security patches. [1] [2] [3] [4] [5] [6]

Dependabot Configuration:

• Added a .github/dependabot.yml file to automate dependency update PRs for both Rust (cargo) and GitHub Actions workflows, scheduled weekly.

Summary by CodeRabbit

• Chores

  • Added automated weekly checks for dependency and workflow updates.
  • Updated project dependencies and build automation components to newer versions.
  • Refreshed certificate generation and validation compatibility with current libraries.
  • Improved build workflow security by applying read-only default repository permissions.

• Tests

  • Updated certificate-related test coverage to use supported APIs while preserving existing validation behavior.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: a38cded2-caa4-40fc-a117-9332f8ea89f5

📥 Commits

Reviewing files that changed from the base of the PR and between 11e9b00 and 9a91d77.

📒 Files selected for processing (1)

• rust/src/platform/signal.rs

Included review availability: Your plan provides up to 4 included reviews per hour; 2 remain after this review.

---

📝 Walkthrough

Walkthrough

The pull request updates Rust dependencies, migrates rcgen certificate generation and validation code to newer APIs, adjusts signal handler casting, upgrades GitHub Actions versions, and adds weekly Dependabot checks.

Changes

Dependency and CI maintenance

Layer / File(s)	Summary
rcgen API migration rust/Cargo.toml, rust/src/keybox/generate.rs	Updates dependency versions and changes production certificate generation to use KeyPair, self_signed, and certificate PEM APIs.
Validation test migration rust/src/keybox/validate.rs	Updates three validation tests to use the new rcgen key-pair, self-signed certificate, and DER APIs.
Signal handler compatibility rust/src/platform/signal.rs	Casts the shutdown handler through *const () before converting it to usize.
Automation update configuration .github/dependabot.yml, .github/workflows/build.yml	Adds weekly Dependabot checks, restricts workflow contents permissions, and upgrades GitHub Actions versions.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 9a91d

This updates dependency and CI maintenance and adjusts shutdown-handler registration compatibility. No concrete current-head issue remains that would block merge.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 60.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 5 functions across 3 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main changes: adding Dependabot configuration and updating Rust dependencies. It does not mention the GitHub Actions upgrades or rcgen API refactor, but the title do…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Warning

Some tools did not complete. Review the errors below.

🔧 Clippy (1.98.0)

Clippy execution failed

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

🔵 Needs a closer look

It upgrades multiple foundational dependencies (including crypto/cert tooling) and CI action major versions, which should be validated by a green CI run and any required runtime smoke checks.

Pull request overview

This pull request modernizes dependency management and CI for the project while updating Rust crypto/certificate code to match newer rcgen APIs.

Changes:

• Updated Rust crate dependencies (notably rcgen, base64, nix, serde_json) and refreshed Cargo.lock.
• Refactored ECDSA P-256 self-signed certificate generation to use rcgen::KeyPair + CertificateParams::self_signed.
• Modernized GitHub Actions workflow action versions and added a weekly Dependabot configuration for Cargo and Actions.

File summaries

File	Description
rust/src/keybox/validate.rs	Updates test certificate creation to the rcgen 0.14 KeyPair/self_signed API and adjusts DER handling accordingly.
rust/src/keybox/generate.rs	Refactors runtime key/cert generation to use KeyPair::generate_for + self_signed, and switches to new PEM accessors.
rust/Cargo.toml	Bumps key Rust dependencies (including rcgen 0.14, base64 0.23, nix 0.31, serde_json patch).
rust/Cargo.lock	Regenerates lockfile to reflect updated transitive dependency graph.
.github/workflows/build.yml	Updates checkout/cache/artifact actions to newer major versions.
.github/dependabot.yml	Adds weekly Dependabot updates for Cargo and GitHub Actions.

Review details

• Files reviewed: 5/6 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

Three references to nonexistent actions/download-artifact@v8 will prevent packaging and release jobs from running.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

• Files reviewed: 6/7 changed files
• Comments generated: 0 new
• Review effort level: Balanced