From 586a0e84e6d363af94a948c245acce5a9f39b401 Mon Sep 17 00:00:00 2001 From: LucaCappelletti94 Date: Thu, 11 Jun 2026 08:57:54 +0200 Subject: [PATCH] CI: Add cargo audit security workflow --- .github/workflows/audit.yml | 48 +++++++++++++++++++++++++++++++++++++ 1 file changed, 48 insertions(+) create mode 100644 .github/workflows/audit.yml diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml new file mode 100644 index 000000000..51e32d673 --- /dev/null +++ b/.github/workflows/audit.yml @@ -0,0 +1,48 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +name: Security audit + +on: + push: + branches-ignore: + - 'gh-readonly-queue/**' + paths: + - '**/Cargo.toml' + - '**/Cargo.lock' + pull_request: + paths: + - '**/Cargo.toml' + - '**/Cargo.lock' + merge_group: + schedule: + # Run every day so newly published advisories are caught even when the + # dependency tree has not changed. + - cron: '0 0 * * *' + +permissions: + contents: read + +jobs: + audit: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - name: Install cargo-audit + run: cargo install cargo-audit --locked + - name: Run cargo audit + run: cargo audit --deny warnings