Add MS Rust toolchain CI leg

.cargo/audit.toml

@@ -1,5 +1,6 @@
 [advisories]
 ignore = [
   "RUSTSEC-2026-0097", # https://github.com/Azure/azure-sdk-for-rust/issues/4183
+  "RUSTSEC-2026-0235", # https://github.com/Azure/azure-sdk-for-rust/issues/4984
 ]
 severity_threshold = "critical"

.github/aw/actions-lock.json

@@ -30,10 +30,10 @@
       "version": "v7.0.1",
       "sha": "043fb46d1a93c77aae656e7c1c64a875d1fc6a0a"
     },
-    "github/gh-aw-actions/setup@v0.83.4": {
+    "github/gh-aw-actions/setup@v0.84.3": {
       "repo": "github/gh-aw-actions/setup",
-      "version": "v0.83.4",
-      "sha": "e89c65e17eb281bbd5ff2ff9e9199a03e96654c7"
+      "version": "v0.84.3",
+      "sha": "c863074b673419603d146aab585e2986ef08deec"
     }
   }
 }

.github/workflows/analyze.yml

@@ -0,0 +1,98 @@
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License.
+
+name: Analyze
+
+on:
+  push:
+    branches:
+      - main
+  schedule:
+    - cron: '0 12 * * *' # Daily at 12:00 PM UTC
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  CARGO_TERM_COLOR: always
+  RUST_BACKTRACE: 1
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    timeout-minutes: 120
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      # Both toolchains are required. Analyze-Code.ps1 runs `cargo +nightly docs-rs`
+      # per package, and eng/scripts/verify-*.rs are cargo scripts whose shebangs
+      # pin `cargo +nightly-2026-04-14 -Zscript`. Stable is installed last so it
+      # stays the active toolchain for everything else.
+      - name: Install Rust nightly
+        shell: pwsh
+        run: ./eng/scripts/Use-Rust.ps1 -Toolchain nightly
+
+      - name: Install Rust stable
+        shell: pwsh
+        run: ./eng/scripts/Use-Rust.ps1 -Toolchain stable
+
+      # Install `cargo install` tools outside CARGO_HOME so they can be cached
+      # independently of the rustup-managed toolchains in ~/.cargo/bin.
+      - name: Configure cargo tool install root
+        run: |
+          echo "CARGO_INSTALL_ROOT=$RUNNER_TEMP/cargo-tools" >> "$GITHUB_ENV"
+          echo "$RUNNER_TEMP/cargo-tools/bin" >> "$GITHUB_PATH"
+
+      # Tool versions are pinned in eng/cgmanifest.json and read by Analyze-Code.ps1,
+      # so a cache hit lets every `cargo install` short-circuit without rebuilding.
+      - name: Cache analysis tools
+        uses: actions/cache@v4
+        with:
+          path: ${{ runner.temp }}/cargo-tools
+          key: ${{ runner.os }}-${{ runner.arch }}-analyze-tools-${{ hashFiles('eng/cgmanifest.json', 'rust-toolchain.toml') }}
+
+      # Downloaded sources are toolchain independent, so an older entry is always safe to reuse.
+      - name: Cache cargo registry
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry/index/
+            ~/.cargo/registry/cache/
+            ~/.cargo/git/db/
+          key: ${{ runner.os }}-${{ runner.arch }}-analyze-registry-${{ hashFiles('Cargo.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-${{ runner.arch }}-analyze-registry-
+
+      # Compiled artifacts are only reusable under the same toolchains, so both the stable
+      # pin (rust-toolchain.toml) and the nightly pin (Language-Settings.ps1) gate the key.
+      - name: Cache cargo build artifacts
+        uses: actions/cache@v4
+        with:
+          path: target/
+          key: ${{ runner.os }}-${{ runner.arch }}-analyze-target-${{ hashFiles('rust-toolchain.toml', 'eng/scripts/Language-Settings.ps1') }}-${{ hashFiles('Cargo.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-${{ runner.arch }}-analyze-target-${{ hashFiles('rust-toolchain.toml', 'eng/scripts/Language-Settings.ps1') }}-
+
+      # Omitting -ServiceDirectory writes package properties for every service under sdk/.
+      # Analyze-Code.ps1 falls back to a workspace-wide shortcut that skips docs-rs
+      # entirely when this directory is missing, so it is required for full coverage.
+      - name: Save package properties
+        shell: pwsh
+        run: ./eng/common/scripts/Save-Package-Properties.ps1 -OutDirectory '${{ runner.temp }}/PackageInfo'
+
+      - name: Run source analysis
+        shell: pwsh
+        run: |
+          ./eng/scripts/Analyze-Code.ps1 `
+            -PackageInfoDirectory '${{ runner.temp }}/PackageInfo' `
+            -Toolchain 'nightly' `
+            -Audit `
+            -Deny

.github/workflows/issue-triage.md

@@ -45,7 +45,8 @@ safe-outputs:
 tools:
     bash: false
     github:
-        toolsets: [issues, pull_requests]
+        # The gateway uses search_repositories to determine repository visibility.
+        toolsets: [issues, pull_requests, repos]
         # If in a public repo, setting `lockdown: false` allows
         # reading issues, pull requests and comments from 3rd-parties.
         # If in a private repo this has no particular effect.