name: Security Audit
on:
push:
branches: [main, bevy-0.19, bevy-0.18]
paths:
- "**/Cargo.toml"
- "**/Cargo.lock"
- "deny.toml"
- ".github/workflows/security.yml"
pull_request:
branches: [main, bevy-0.19, bevy-0.18]
paths:
- "**/Cargo.toml"
- "**/Cargo.lock"
- "deny.toml"
- ".github/workflows/security.yml"
schedule:
- cron: "0 9 * * 1"
workflow_dispatch:
permissions: {}
concurrency:
group: security-${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
jobs:
audit:
name: Security Audit
runs-on: ubuntu-latest
permissions:
contents: read
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
- name: Install Rust toolchain
uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8
- name: Install cargo-audit
run: cargo install cargo-audit --locked
- name: Run security audit
run: cargo audit --ignore RUSTSEC-2024-0436
deny:
name: Cargo Deny
runs-on: ubuntu-latest
permissions:
contents: read
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
- name: Install Rust toolchain
uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8
- name: Install cargo-deny
run: cargo install cargo-deny --locked
- name: Check licenses
run: cargo deny check --config deny.toml licenses
- name: Check bans
run: cargo deny check --config deny.toml bans
- name: Check advisories
run: cargo deny check --config deny.toml advisories
- name: Check sources
run: cargo deny check --config deny.toml sources