security-audit.yml

name: Security Audit

on:
  pull_request:
    types: [opened, synchronize, reopened]
  push:
    branches:
      - master
  schedule:
    # Run security audit daily at 00:00 UTC
    - cron: '0 0 * * *'

concurrency:
  group: ${{ github.workflow }}-${{ github.ref_name }}
  cancel-in-progress: true

jobs:
  cargo-audit:
    name: Dependency Security Audit
    runs-on: ubuntu-latest
    if: github.actor != 'dependabot[bot]'

    steps:
      - name: Checkout code
        uses: actions/checkout@v6
        with:
          ref: ${{ github.sha }}
          fetch-depth: 1

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      - name: Cache cargo-audit
        uses: actions/cache@v5
        with:
          path: ~/.cargo/bin/cargo-audit
          key: ${{ runner.os }}-cargo-audit-${{ hashFiles('**/Cargo.lock') }}

      - name: Install cargo-audit
        run: which cargo-audit || cargo install cargo-audit --locked

      - name: Run cargo audit
        run: cargo audit

      - name: Report status
        if: success()
        run: echo "✅ No known vulnerabilities found in dependencies"