name: Security
on:
push:
branches: [ main, master ]
pull_request:
branches: [ main, master ]
schedule:
- cron: "31 2 * * 1"
workflow_dispatch:
permissions:
contents: read
jobs:
cargo-audit:
name: cargo audit
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Install Rust
uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 with:
toolchain: stable
- name: Install cargo-audit
uses: taiki-e/install-action@2ca9b94c269419b7b0c711c09d0b21c4e1d51145 with:
tool: cargo-audit
- name: Prepare audit config and lockfile
shell: bash
run: |
mkdir -p .cargo
cp audit.toml .cargo/audit.toml
cargo generate-lockfile
- name: Run cargo audit
run: cargo audit --file Cargo.lock
cargo-deny:
name: cargo deny
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Install Rust
uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 with:
toolchain: stable
- name: Install cargo-deny
uses: taiki-e/install-action@2ca9b94c269419b7b0c711c09d0b21c4e1d51145 with:
tool: cargo-deny
- name: Prepare lockfile
run: cargo generate-lockfile
- name: Run cargo deny
run: cargo deny --config deny.toml --locked check advisories bans licenses sources