cargo-audit.yml

# SPDX-License-Identifier: MPL-2.0
# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
#
# cargo-audit.yml — Dependency vulnerability scanning for Rust projects.
# Runs cargo-audit against the RustSec advisory database.
name: Cargo Audit

on:
  pull_request:
    branches: ['**']
  push:
    branches: [main, master]
  schedule:
    # Run weekly on Monday at 06:00 UTC to catch new advisories.
    - cron: '0 6 * * 1'

# Cause-B mitigation (#77): cancel superseded runs so stacked pushes
# to the same ref don't pile up identical jobs in the queue.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  audit:
    name: Dependency audit
    runs-on: ubuntu-latest
    timeout-minutes: 10

    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Detect Cargo.lock
        id: detect
        run: |
          if [ -f Cargo.lock ]; then
            echo "present=true" >> "$GITHUB_OUTPUT"
          else
            echo "present=false" >> "$GITHUB_OUTPUT"
            echo "No Cargo.lock — skipping dependency audit." >> "$GITHUB_STEP_SUMMARY"
          fi

      - name: Install Rust toolchain
        if: steps.detect.outputs.present == 'true'
        uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable

      - name: Install cargo-audit
        if: steps.detect.outputs.present == 'true'
        run: cargo install cargo-audit --locked

      - name: Run cargo audit
        if: steps.detect.outputs.present == 'true'
        run: cargo audit

      - name: Write summary
        if: always() && steps.detect.outputs.present == 'true'
        run: |
          echo "## Cargo Audit Results" >> "$GITHUB_STEP_SUMMARY"
          echo "" >> "$GITHUB_STEP_SUMMARY"
          cargo audit 2>&1 | tail -20 >> "$GITHUB_STEP_SUMMARY" || true