security.yml

name: Security

on:
  push:
    branches: ["master"]
    paths-ignore:
      - "README.md"
  pull_request:
    branches: ["master"]
    paths-ignore:
      - "README.md"
  workflow_dispatch:
  schedule:
    - cron: "17 5 * * 1"

permissions:
  contents: read
  security-events: write

concurrency:
  group: security-${{ github.ref }}
  cancel-in-progress: true

jobs:
  cargo-audit-deny:
    name: Cargo audit + deny
    runs-on: ubuntu-latest
    env:
      CARGO_TERM_COLOR: always
      RUSTFLAGS: "-C target-cpu=generic"
    steps:
      - uses: actions/checkout@v4

      - name: Setup Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      - name: Cache Rust artifacts
        uses: Swatinem/rust-cache@v2

      - name: Install cargo-audit and cargo-deny
        uses: taiki-e/install-action@v2
        with:
          tool: cargo-audit,cargo-deny

      - name: Cargo audit
        run: cargo audit

      - name: Cargo deny (advisories, bans, licenses, sources)
        run: cargo deny check advisories bans licenses sources --config deny.toml