audit.yml

name: Security Audit

on:
  push:
    paths:
      - '**/Cargo.toml'
      - '**/Cargo-recent.lock'
      - '**/Cargo-minimal.lock'
  pull_request:
    paths:
      - '**/Cargo.toml'
      - '**/Cargo-recent.lock'
      - '**/Cargo-minimal.lock'
  schedule:
    - cron: '0 0 * * 0' # Sunday @ 00:00:00 UTC
  workflow_dispatch:
env:
  CARGO_TERM_COLOR: always
permissions: {}

jobs:
  audit:
    name: cargo audit
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: read
      security-events: write
      issues: write

    steps:
      - name: Checkout code
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
        with:
          persist-credentials: false

      - name: Install Rust toolchain and configure cache
        uses: actions-rust-lang/setup-rust-toolchain@2b1f5e9b395427c92ee4e3331786ca3c37afe2d7 # v1.16.0
        with:
          toolchain: stable
          cache: true

      - name: Install cargo-audit
        run: cargo install cargo-audit --locked

      - name: Run cargo audit
        run: cargo audit --deny warnings

      - name: Upload SARIF to GitHub Security tab
        uses: rustsec/audit-check@69366f33c96575abad1ee0dba8212993eecbe998
        with:
          token: ${{ secrets.GITHUB_TOKEN }}