security-audit.yaml

# SPDX-FileCopyrightText: slowtec GmbH
# SPDX-License-Identifier: CC0-1.0

# yaml-language-server: $schema=https://json.schemastore.org/github-workflow

name: security-audit

on:
  push:
    paths:
      - "**/Cargo.toml"
  #schedule:
  #  - cron: '0 0 * * *'
  workflow_dispatch:

env:
  CARGO_TERM_COLOR: always

jobs:
  run:
    runs-on: ubuntu-latest

    steps:
      # TODO: Remove manual installation of toolchain after
      # https://github.com/actions-rs/audit-check/issues/215
      # has been resolved.
      - uses: dtolnay/rust-toolchain@stable

      - name: Install cargo-binstall
        uses: cargo-bins/cargo-binstall@main

      - name: Install cargo-audit
        run: cargo binstall cargo-audit

      - uses: actions/checkout@v6
        with:
          persist-credentials: false

      - name: Cache Rust toolchain and build artifacts
        uses: Swatinem/rust-cache@v2
        with:
          # Distinguished by the action name to avoid sharing across different actions!
          shared-key: ${{ github.workflow }}-${{ github.job }}

      - name: Run security audit
        run: cargo audit --deny unsound --deny yanked