Dependency Audit #3

	name: Dependency Audit

	on:
	push:
	branches: [main]
	pull_request:
	branches: [main]
	schedule:
	# Weekly scan on Mondays at 06:00 UTC.
	- cron: "0 6 * * 1"

	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true

	jobs:
	cargo-audit:
	name: Cargo Audit
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4

	- name: Install Rust toolchain
	uses: dtolnay/rust-toolchain@stable

	- name: Cache cargo registry
	uses: actions/cache@v4
	with:
	path: \|
	~/.cargo/registry
	~/.cargo/git
	key: ${{ runner.os }}-cargo-audit-${{ hashFiles('**/Cargo.lock') }}
	restore-keys: ${{ runner.os }}-cargo-audit-

	- name: Install cargo-audit
	run: cargo install cargo-audit --locked

	- name: Run cargo audit
	working-directory: contracts/stellar-give
	run: cargo audit --deny warnings

	npm-audit:
	name: NPM Audit
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4

	- name: Setup Node.js
	uses: actions/setup-node@v4
	with:
	node-version: "20"
	cache: "npm"
	cache-dependency-path: frontend/package-lock.json

	- name: Install dependencies
	working-directory: frontend
	run: npm ci

	- name: Run npm audit
	working-directory: frontend
	# Scope to production deps (dev/build tooling like vite, eslint, storybook
	# never ships to users) and fail on critical. The remaining high advisories
	# (axios via @stellar/stellar-sdk, next) only have fixes behind breaking
	# major upgrades (@stellar/stellar-sdk v15, next 16) tracked as a separate
	# dependency-modernization task; the critical Next.js advisory is already patched.
	run: npm audit --omit=dev --audit-level=critical

Navigation Menu