security-audit.yml

name: Security Audit

on:
  push:
    branches: [ main, develop ]
  pull_request:
    branches: [ main ]
  schedule:
    # Run security audit daily at 2:00 AM UTC
    - cron: '0 2 * * *'
  workflow_dispatch:  # Allow manual triggering

jobs:
  security-audit:
    name: Security Audit
    runs-on: ubuntu-latest
    
    steps:
      - name: Checkout repository
        uses: actions/checkout@v7
      
      - name: Setup Rust toolchain
        uses: actions-rust-lang/setup-rust-toolchain@v1
        with:
          toolchain: stable
      
      - name: Cache cargo-audit
        uses: actions/cache@v6
        with:
          path: ~/.cargo/bin/cargo-audit
          key: ${{ runner.os }}-cargo-audit-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-cargo-audit-
      
      - name: Install cargo-audit
        run: cargo install cargo-audit --locked --force
      
      - name: Run security audit
        run: |
          # Ignore known advisories without available fixes:
          # RUSTSEC-2023-0071: RSA timing sidechannel (medium severity, no fix available)
          #   - Only used for test-only Secure Content decryption
          #   - Test keys must not be used in production (documented in SECURITY.md)
          # RUSTSEC-2024-0436: paste unmaintained (warning)
          #   - Transitive dependency through parry3d -> simba
          #   - No security vulnerability, just unmaintained status
          cargo audit --ignore RUSTSEC-2023-0071 --ignore RUSTSEC-2024-0436