name: Security
on:
push:
branches: [main]
pull_request:
branches: [main]
jobs:
codeql:
name: CodeQL
runs-on: ubuntu-latest
permissions:
security-events: write
contents: read
packages: read
steps:
- uses: actions/checkout@v7
- uses: github/codeql-action/init@v4
with:
languages: rust
queries: security-extended
- uses: github/codeql-action/analyze@v4
with:
category: "/language:rust"
cargo-audit:
name: Cargo Audit
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v7
- uses: dtolnay/rust-toolchain@stable
- uses: Swatinem/rust-cache@v2
- run: cargo install cargo-audit
- run: cargo audit