Merge pull request #1975 from habitat-sh/audit

add cargo audit workflow to ci

Author: mwrock

.cargo/audit.toml

@@ -0,0 +1,34 @@
+# cargo audit config file
+# https://github.com/rustsec/rustsec/blob/main/cargo-audit/audit.toml.example
+#
+# All of the options which can be passed via CLI arguments can also be
+# permanently specified in this file.
+
+[advisories]
+
+# advisory IDs to ignore e.g. ["RUSTSEC-2019-0001", ...]
+ignore = []
+
+# warn for categories of informational advisories
+informational_warnings = ["notice", "unmaintained", "unsound"]
+
+# CVSS severity ("none", "low", "medium", "high", "critical")
+severity_threshold = "none"
+
+# Advisory Database Configuration
+[database]
+path = ".cargo/advisory-db"                        # Path where advisory git repo will be cloned
+url = "https://github.com/RustSec/advisory-db.git" # URL to git repo
+fetch = true                                       # Perform a `git fetch` before auditing (default: true)
+stale = false                                      # Allow stale advisory DB (i.e. no commits for 90 days, default: false)
+
+# Output Configuration
+[output]
+deny = ["warnings", "unmaintained", "unsound", "yanked"] # exit on error if these are found
+format = "terminal"                                      # "terminal" (human readable report) or "json"
+quiet = false                                            # Only print information on error
+show_tree = true                                         # Show inverse dependency trees along with advisories (default: true)
+
+[yanked]
+enabled = true      # Warn for yanked crates in Cargo.lock (default: true)
+update_index = true # Auto-update the crates.io index (default: true)

.github/workflows/rust-cargo-audit-check.yml

@@ -0,0 +1,21 @@
+# https://github.com/actions-rs/audit-check
+name: Rust Cargo Audit
+on:
+  push:
+permissions:
+  contents: read
+  jobs:
+  security_audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: dtolnay/rust-toolchain@1.91.1
+        id: toolchain
+      - run: rustup override set ${{steps.toolchain.outputs.name}}
+      - uses: ClementTsang/cargo-action@v0.0.7
+        with:
+          command: install
+          args: cargo-audit
+      - uses: ClementTsang/cargo-action@v0.0.7
+        with:
+          command: audit

.gitignore

@@ -2,6 +2,8 @@
 *.rustfmt
 *.sig.key
 *.sym.key
+.cargo/advisory-db/
+.cargo/advisory-db..lock
 .DS_Store
 .secrets/*
 !.secrets/habitat-env.sample