name: Dependency and workflow security
on:
push:
paths:
- .github/**
- Cargo.toml
- Cargo.lock
- deny.toml
pull_request:
paths:
- .github/**
- Cargo.toml
- Cargo.lock
- deny.toml
workflow_dispatch:
permissions:
contents: read
jobs:
cargo-deny:
runs-on: ubuntu-26.04
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with:
persist-credentials: false
- uses: EmbarkStudios/cargo-deny-action@3c6349835b2b7b196a839186cb8b78e02f7b5f25 with:
rust-version: "1.97.1"
zizmor:
runs-on: ubuntu-26.04
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with:
persist-credentials: false
- uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 - run: uvx "zizmor==1.30.1" --collect=workflows --strict-collection .github