[debba]

The Security audit job fails on pushes to main: chacha20 0.10.1 is yanked, and rustsec/audit-check tries to report that warning as a check run without checks: write ("Resource not accessible by integration"). This updates chacha20 to 0.10.2 and grants the job checks: write. No vulnerabilities were reported.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (2 files)

• .github/workflows/ci.yml - Job-level permissions (contents: read, checks: write) added to the audit job; least-privilege and sufficient for rustsec/audit-check@v2 to create check runs.
• Cargo.lock - chacha20 bumped 0.10.1 (yanked) → 0.10.2; transitive dependency (not declared in any Cargo.toml), so the lock-file-only update is correct.

---

_{Reviewed by kimi-k3 · Input: 62.5K · Output: 3.3K · Cached: 64.5K}