name: Security Audit
# Now handled locally via scripts/check.sh (cargo audit + cargo deny).
# Kept as manual fallback.
on:
workflow_dispatch: # manual only
# push:
# branches: [main]
# pull_request:
# schedule:
# - cron: "0 6 * * 1"
permissions:
contents: read
checks: write
jobs:
audit:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
- uses: rustsec/audit-check@v2
with:
token: ${{ secrets.GITHUB_TOKEN }}
deny:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
- uses: EmbarkStudios/cargo-deny-action@v2
with:
command: check
arg: --all-features