name: Scheduled Audit
# RustSec advisories are published on their own schedule, not ours — a quiet
# repo can accumulate advisories with no push to trigger the build-time audit
# gate. This weekly run catches those. (Push/PR-time auditing lives in
# build.yml's `audit` job.)
on:
schedule:
- cron: "17 6 * * 1" # Mondays 06:17 UTC
workflow_dispatch:
jobs:
audit:
name: cargo audit (scheduled)
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v5
- uses: dtolnay/rust-toolchain@stable
- name: Install cargo-audit
uses: taiki-e/install-action@cargo-audit
- name: Audit dependencies (RustSec advisories)
run: cargo audit