audit

audit #137

	name: audit

	# Advisory monitoring runs on a different cadence than code-change CI:
	# * push to main: catch advisories merged in via Cargo.lock churn
	# * PR touching deps: block introduction of a vulnerable transitive
	# * daily schedule: surface advisories published while the tree is idle
	# * manual dispatch: ad-hoc checks
	on:
	push:
	branches: [main]
	paths:
	- 'Cargo.lock'
	- '.cargo/audit.toml'
	- '.github/workflows/audit.yml'
	pull_request:
	paths:
	- 'Cargo.lock'
	- '.cargo/audit.toml'
	- '.github/workflows/audit.yml'
	schedule:
	# 06:17 UTC. Odd minute avoids the on-the-hour cron spike on GitHub.
	- cron: '17 6 * * *'
	workflow_dispatch:

	permissions:
	contents: read

	jobs:
	audit:
	name: audit
	runs-on: ubuntu-24.04
	timeout-minutes: 5
	permissions:
	contents: read
	# rustsec/audit-check posts findings as PR review comments / checks.
	# Fork PRs receive a read-only GITHUB_TOKEN; the action degrades to
	# log-only output in that case rather than failing.
	issues: write
	checks: write
	steps:
	- uses: actions/checkout@v7
	- uses: rustsec/audit-check@v2.0.0
	with:
	token: ${{ secrets.GITHUB_TOKEN }}

Navigation Menu