1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
name: security
on:
push:
branches:
pull_request:
schedule:
# Run weekly on Mondays at 08:00 UTC (catches new advisories without code changes)
- cron: "0 8 * * 1"
env:
CARGO_TERM_COLOR: always
# Cancel superseded runs for the same branch/PR to save runner minutes.
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
jobs:
audit:
name: cargo audit
runs-on: ubuntu-latest
timeout-minutes: 30
# rustsec/audit-check writes check results and, on scheduled runs, opens
# issues for new advisories. Declare the permissions explicitly so the job
# behaves consistently regardless of the repo/org default GITHUB_TOKEN scope.
permissions:
checks: write
contents: read
issues: write
steps:
- uses: actions/checkout@v5
- uses: rustsec/audit-check@v2
with:
token: ${{ secrets.GITHUB_TOKEN }}
deny:
name: cargo deny
runs-on: ubuntu-latest
timeout-minutes: 30
steps:
- uses: actions/checkout@v5
- uses: EmbarkStudios/cargo-deny-action@v2
with:
# The action's default Docker image ships an older Cargo that cannot
# read the v4 Cargo.lock this repo commits. Update to a toolchain that
# understands the current lockfile format before running cargo-deny.
rust-version: stable