docs: configuration.md route/policy section catches up to 1.2.1 (sock… #18

	name: Security

	# Supply-chain checks: scan the dependency graph for known advisories and enforce
	# the license/source/duplicate policy in deny.toml. Runs on dependency changes AND
	# on a weekly schedule — a crate already in Cargo.lock can have an advisory filed
	# AFTER it was merged, so PR-time scanning alone is not enough.
	on:
	push:
	branches: [main]
	paths:
	- "Cargo.toml"
	- "Cargo.lock"
	- "deny.toml"
	- ".github/workflows/security.yml"
	pull_request:
	paths:
	- "Cargo.toml"
	- "Cargo.lock"
	- "deny.toml"
	- ".github/workflows/security.yml"
	schedule:
	# Mondays 07:00 UTC — catch newly-disclosed advisories against pinned deps.
	- cron: "0 7 * * 1"

	permissions:
	contents: read

	jobs:
	cargo-deny:
	name: cargo-deny (advisories · licenses · sources · bans)
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v7
	- name: cargo-deny
	uses: EmbarkStudios/cargo-deny-action@v2
	with:
	command: check advisories licenses sources bans

Navigation Menu