security.yml

name: Security audit

on:
  schedule:
    - cron: "0 9 * * *"
  push:
    branches: [main]
    paths:
      - "**/Cargo.toml"
      - "**/Cargo.lock"
      - "deny.toml"
      - ".cargo/audit.toml"
      - ".github/workflows/security.yml"
  workflow_dispatch:

permissions:
  contents: read
  issues: write

jobs:
  audit:
    name: cargo audit + cargo deny advisories
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v6
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - uses: taiki-e/install-action@cargo-audit
      - name: cargo audit
        run: cargo audit --deny warnings
      - name: cargo deny (advisories)
        uses: EmbarkStudios/cargo-deny-action@v2
        with:
          command: check advisories