security.yml

name: Security Audit

permissions:
  contents: read
  checks: write
  actions: read

on:
  push:
    branches: ["master", "main"]
  pull_request:
    branches: ["master", "main"]
  schedule:
    - cron: "0 3 * * 1"

jobs:
  cargo-audit:
    name: cargo-audit
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
      - name: Ensure Rust toolchain
        run: |
          rustup default stable
      - name: Run cargo audit
        uses: rustsec/audit-check@v1
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          ignore: RUSTSEC-2023-0071

  cargo-deny:
    name: cargo-deny
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
      - name: Ensure Rust toolchain
        run: |
          rustup default stable
      - name: Install cargo-deny
        run: cargo install cargo-deny --locked
      - name: Run cargo deny
        run: cargo deny check