name: Security Audit
on:
push:
paths:
- '**/Cargo.toml'
- '**/Cargo-recent.lock'
- '**/Cargo-minimal.lock'
pull_request:
paths:
- '**/Cargo.toml'
- '**/Cargo-recent.lock'
- '**/Cargo-minimal.lock'
schedule:
- cron: '0 0 * * 0' workflow_dispatch:
env:
CARGO_TERM_COLOR: always
permissions: {}
jobs:
audit:
name: cargo audit
runs-on: ubuntu-latest
timeout-minutes: 15
permissions:
contents: read
security-events: write
issues: write
steps:
- name: Checkout code
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 with:
persist-credentials: false
- name: Install Rust toolchain and configure cache
uses: actions-rust-lang/setup-rust-toolchain@2b1f5e9b395427c92ee4e3331786ca3c37afe2d7 with:
toolchain: stable
cache: true
- name: Install cargo-audit
run: cargo install cargo-audit --locked
- name: Run cargo audit
run: cargo audit --deny warnings
- name: Upload SARIF to GitHub Security tab
uses: rustsec/audit-check@69366f33c96575abad1ee0dba8212993eecbe998
with:
token: ${{ secrets.GITHUB_TOKEN }}