name: Security Audit
on:
push:
branches: [master]
pull_request:
schedule:
- cron: '0 0 * * *'
workflow_dispatch:
jobs:
changes:
name: Detect Changes
runs-on: ubuntu-latest
permissions:
contents: read
pull-requests: read
outputs:
deps: ${{ steps.changes.outputs.deps }}
steps:
- uses: actions/checkout@v6
- uses: dorny/paths-filter@v3
id: changes
with:
filters: |
deps:
- '.github/workflows/security.yml'
- '.github/dependabot.yml'
- '**/Cargo.toml'
- '**/Cargo.lock'
audit:
name: Audit Dependencies
runs-on: ubuntu-latest
needs: changes
if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || needs.changes.outputs.deps == 'true'
permissions:
contents: read
issues: write
steps:
- uses: actions/checkout@v6
- name: Install cargo-audit
run: cargo install cargo-audit
- name: Run audit check
run: cargo audit --ignore RUSTSEC-2024-0436