name: Dependencies
on:
schedule:
- cron: '0 3 * * 1'
workflow_dispatch:
pull_request:
paths:
- 'Cargo.toml'
- 'Cargo.lock'
env:
CARGO_TERM_COLOR: always
jobs:
check-deps:
name: Check Dependencies
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v6
- name: Install Rust
uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
with:
toolchain: stable
- name: Cache Rust dependencies
uses: swatinem/rust-cache@v2
with:
shared-key: "deps"
- name: Cache cargo-machete
id: cache-cargo-machete
uses: actions/cache@v5
with:
path: ~/.cargo/bin/cargo-machete
key: cargo-machete-${{ runner.os }}
- name: Install cargo-machete if not cached
if: steps.cache-cargo-machete.outputs.cache-hit != 'true'
run: cargo install cargo-machete --locked
- name: Cache cargo-outdated
id: cache-cargo-outdated
uses: actions/cache@v5
with:
path: ~/.cargo/bin/cargo-outdated
key: cargo-outdated-${{ runner.os }}
- name: Install cargo-outdated if not cached
if: steps.cache-cargo-outdated.outputs.cache-hit != 'true'
run: cargo install cargo-outdated --locked
- name: Cache cargo-audit
id: cache-cargo-audit
uses: actions/cache@v5
with:
path: ~/.cargo/bin/cargo-audit
key: cargo-audit-${{ runner.os }}
- name: Install cargo-audit if not cached
if: steps.cache-cargo-audit.outputs.cache-hit != 'true'
run: cargo install cargo-audit --locked
- name: Check for unused dependencies
run: cargo machete
- name: Security audit
run: cargo audit
- name: Check outdated dependencies (informational)
run: |
echo "::group::Outdated Dependencies"
cargo outdated || true
echo "::endgroup::"
continue-on-error: true
update-check:
name: Update Check
runs-on: ubuntu-latest
if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
steps:
- name: Checkout code
uses: actions/checkout@v6
- name: Install Rust
uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
with:
toolchain: stable
- name: Cache Rust dependencies
uses: swatinem/rust-cache@v2
with:
shared-key: "deps"
- name: Try updating dependencies
run: |
cargo update --dry-run 2>&1 | tee update-report.txt
- name: Create update report
run: |
echo "# Dependency Update Report" > update-summary.md
echo "" >> update-summary.md
echo "## Available Updates" >> update-summary.md
echo '```' >> update-summary.md
grep -E "Updating|Adding|Removing" update-report.txt || echo "No updates available"
echo '```' >> update-summary.md
- name: Upload update report
uses: actions/upload-artifact@v7
with:
name: dependency-update-report
path: update-summary.md
retention-days: 7