1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
name: Security
on:
push:
branches:
# No `branches:` filter on `pull_request`. With one, a pull request
# whose base is another branch -- a stacked PR, the natural shape for
# a change that builds on an unmerged one -- matches nothing and gets
# **no checks at all**. Not a red build: an empty one, which reads as
# "nothing to report" rather than "nothing ran".
#
# `push` stays pinned to `main` so a branch does not build twice, once
# for the push and once for its pull request.
pull_request:
branches:
schedule:
- cron: "0 3 * * *"
permissions:
contents: read
jobs:
audit:
name: cargo audit
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # master
with:
toolchain: 1.98.0
- name: Install cargo-audit
run: cargo install cargo-audit --locked
- name: Audit
run: cargo audit
deny:
name: cargo deny
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- uses: EmbarkStudios/cargo-deny-action@3c6349835b2b7b196a839186cb8b78e02f7b5f25 # v2