ci: add cargo audit workflow

[pau-hedgehog]

No description provided.

[pau-hedgehog]

I'm not sure you have this covered somewhere else. So far it could show 2 unmaintained crates: https://github.com/githedgehog/dataplane/actions/runs/17985301616/job/51161859356?pr=867

[mvachhar]

Is there an image we can use with cargo audit installed instead of installing and building it each time?

[pau-hedgehog]

Is there an image we can use with cargo audit installed instead of installing and building it each time?

Found an image but it's very old: https://github.com/simonhyll/cargo-audit/pkgs/container/cargo-audit

I guess we could build our own runner image but instead I propose to use another Action which is officially maintained and uses caching, which skips the redundant scan:

• initial run (2m 44s): https://github.com/githedgehog/dataplane/actions/runs/17992695074/attempts/1
• cache hit (13s): https://github.com/githedgehog/dataplane/actions/runs/17992695074/job/51186165551

Additionally, we may consider running dependabot for rust. I can raise a separate PR for it

[qmonnet]

Thanks @pau-hedgehog, I think we're already covered for this repo.

We've got cargo deny set up in CI, and my understanding is that it checks advisories like cargo audit does (plus some other things). The two advisories that you found as warnings are known and explicitly ignored in deny.toml. Is there anything more that you're trying to get via cargo audit?

We also have Dependabot setup for the repo, along with our own workflow to bump dependencies with cargo update and cargo upgrade. Happy to walk you through if you want the details.

[pau-hedgehog]

Thanks @pau-hedgehog, I think we're already covered for this repo.

Ok, then I'm closing this. Sorry for wasting your time

We've got cargo deny set up in CI, and my understanding is that it checks advisories like cargo audit does (plus some other things). The two advisories that you found as warnings are known and explicitly ignored in deny.toml. Is there anything more that you're trying to get via cargo audit?

After updating the govulncheck in our Go repos I was doing my first incursion in the Rust world to see if there was something equivalent. Next time I'll spend some more time researching and/or asking. Thanks

[qmonnet]

No problem at all, thanks for looking into this!