dependency-audit.yml

name: Dependency security audit

on:
  push:
    paths:
      - '**/Cargo.toml'
      - '**/Cargo.lock'

env:
  CARGO_TERM_COLOR: always
  CARGO_INCREMENTAL: 0

jobs:
  security_audit:
    timeout-minutes: 10
    runs-on: ubuntu-latest
    permissions:
      contents: read
      checks: write
    steps:
      - name: Check out
        uses: actions/checkout@v4

      - name: Cache audit-check build
        id: cache-audit-check
        uses: actions/cache@v4
        continue-on-error: false
        with:
          path: |
            ~/.cargo/bin/
            ~/.cargo/registry/index/
            ~/.cargo/registry/cache/
            ~/.cargo/git/db/
            target/
          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: ${{ runner.os }}-cargo-

      - name: Run audit-check action
        run: |
          which cargo-deny || cargo install cargo-deny
          cargo deny check