name: Security
on:
push:
branches: [main]
paths:
- "Cargo.toml"
- "Cargo.lock"
- "**/Cargo.toml"
- ".github/workflows/security.yml"
pull_request:
branches: [main]
paths:
- "Cargo.toml"
- "Cargo.lock"
- "**/Cargo.toml"
- ".github/workflows/security.yml"
schedule:
- cron: "0 4 * * 0"
permissions:
contents: read
security-events: write
pull-requests: write
jobs:
cargo-audit:
name: Vulnerabilities
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v6
- name: Run cargo-audit
uses: rustsec/audit-check@v2.0.0
with:
token: ${{ secrets.GITHUB_TOKEN }}
dependency-review:
name: Dependency Review
runs-on: ubuntu-latest
if: github.event_name == 'pull_request'
permissions:
contents: read
pull-requests: write
steps:
- name: Checkout code
uses: actions/checkout@v6
- name: Dependency Review
uses: actions/dependency-review-action@v4
with:
fail-on-severity: moderate
deny-licenses: GPL-2.0, GPL-3.0, AGPL-3.0, LGPL-2.0, LGPL-2.1, LGPL-3.0
comment-summary-in-pr: always