39 lines
983 B
YAML
39 lines
983 B
YAML
# Security audit workflow
|
|
name: Security Audit
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
paths:
|
|
- '**/Cargo.toml'
|
|
- '**/Cargo.lock'
|
|
pull_request:
|
|
paths:
|
|
- '**/Cargo.toml'
|
|
- '**/Cargo.lock'
|
|
schedule:
|
|
- cron: '0 0 * * 1'
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
# cargo-audit: vulnerability scanning (advisory DB)
|
|
cargo-audit:
|
|
runs-on: ubuntu-latest
|
|
continue-on-error: true
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: rustsec/audit-check@v2
|
|
with:
|
|
token: ${{ secrets.GITHUB_TOKEN }}
|
|
# quick-xml < 0.41.0: no upstream fix in wayland-scanner 0.31.x,
|
|
# zbus_xml 5.1.x, or xcb 1.7.0 (via zed-scap). Remove once patched.
|
|
ignore: RUSTSEC-2026-0194,RUSTSEC-2026-0195
|
|
|
|
# cargo-deny: license compliance + advisory + duplicate detection
|
|
cargo-deny:
|
|
runs-on: ubuntu-latest
|
|
continue-on-error: true
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: EmbarkStudios/cargo-deny-action@v2
|