1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
name: Security Audit
# Advisories land against dependency versions that are already pinned, so this
# has to run on a timer as well as on change. The pull request trigger is what
# used to be a second, separate audit job in rust.yml using a different action.
on:
push:
branches:
- master
pull_request:
schedule:
- cron: "0 2 * * *" # run at 2 AM UTC
workflow_dispatch:
permissions:
contents: read
jobs:
security-audit:
# Branch protection requires this exact check name. Renaming it silently
# blocks every pull request, because a required check that never reports
# never passes.
name: Security audit
permissions:
checks: write # for the action to create a check
contents: read # for actions/checkout to fetch code
issues: write # for the action to file advisories it finds
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v5
- name: Install rust
uses: actions-rust-lang/setup-rust-toolchain@v1
with:
cache: false
rustflags: ""
# No `cargo generate-lockfile` here. Cargo.lock is committed, and
# regenerating it re-resolves every dependency to the newest compatible
# version, so the audit would cover versions nobody builds and would miss
# a vulnerable pin that is actually in the lockfile.
- name: Audit check
uses: actions-rust-lang/audit@v1
with:
token: ${{ secrets.GITHUB_TOKEN }}