Security audit #67
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Security audit | |
| on: | |
| # Run whenever dependency files change so a newly-published advisory is | |
| # caught as soon as the PR that bumps a dep is opened. | |
| push: | |
| paths: | |
| - "**/Cargo.toml" | |
| - "**/Cargo.lock" | |
| pull_request: | |
| paths: | |
| - "**/Cargo.toml" | |
| - "**/Cargo.lock" | |
| # Weekly sweep even when no deps changed, because new advisories are | |
| # published continuously against existing versions. | |
| schedule: | |
| - cron: "0 8 * * Mon" | |
| # Allow manual triggering from the Actions tab. | |
| workflow_dispatch: | |
| jobs: | |
| audit: | |
| name: cargo audit | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 | |
| # rustsec/audit-check fetches the advisory database, runs cargo audit, | |
| # and annotates the PR / commit with any findings. | |
| - uses: rustsec/audit-check@69366f33c96575abad1ee0dba8212993eecbe998 # v2 | |
| with: | |
| token: ${{ secrets.GITHUB_TOKEN }} |