1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
# CI, hardened against the workflow supply-chain attack patterns:
# - every third-party action is pinned to a full commit SHA (a moved tag
# cannot swap code under us) — and there is only one, actions/checkout;
# the Rust toolchain comes from the runner's own rustup, not an action
# - the workflow token is read-only and no secrets exist here at all
# - no pull_request_target, and no `${{ }}` interpolation of untrusted
# strings into run: steps
name: CI
on:
push:
branches:
pull_request:
schedule:
# Weekly RustSec advisory sweep — advisories land without code changes.
- cron: "17 6 * * 1"
permissions:
contents: read
concurrency:
group: ci-${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
jobs:
test:
if: github.event_name != 'schedule'
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
- name: Update stable toolchain
run: rustup update --no-self-update stable && rustup default stable
- run: cargo fmt --check
- run: cargo clippy --all-targets -- -D warnings
- run: cargo test
- name: Verify the crate packages and builds standalone
run: cargo publish --dry-run
audit:
runs-on: ubuntu-latest
env:
# Bump deliberately; the cache key below makes a bump trigger a rebuild.
CARGO_AUDIT_VERSION: 0.22.2
steps:
- uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
- name: Update stable toolchain
run: rustup update --no-self-update stable && rustup default stable
- name: Cache the cargo-audit binary
# GitHub's first-party cache action, SHA-pinned like checkout. Only the
# compiled auditor is cached — never the advisory DB, which must be
# fetched fresh each run for the sweep to mean anything.
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
with:
path: ~/.cargo/bin/cargo-audit
key: cargo-audit-${{ env.CARGO_AUDIT_VERSION }}-${{ runner.os }}
- name: Install cargo-audit (on cache miss)
# Built from source off crates.io rather than pulling a third-party
# action or prebuilt binary; --locked pins its dependency tree.
run: |
command -v cargo-audit >/dev/null ||
cargo install cargo-audit --locked --version "$CARGO_AUDIT_VERSION"
- run: cargo audit