Audit

Audit #235

	name: Audit

	on:
	push:
	pull_request:
	schedule:
	- cron: "0 0 * * *" # Nightly
	workflow_dispatch:

	permissions: {}
	env:
	CARGO_TERM_COLOR: always

	jobs:
	cargo-audit:
	name: Cargo Audit - ${{ matrix.name }}
	runs-on: ubuntu-latest
	permissions:
	contents: read
	checks: write
	issues: write
	strategy:
	max-parallel: 1
	fail-fast: false
	matrix:
	include:
	- name: Fresh Lockfile
	lockfile: Cargo.lock
	- name: Recent Lockfile
	lockfile: Cargo-recent.lock
	- name: Minimal Lockfile
	lockfile: Cargo-minimal.lock

	steps:
	- name: Checkout Repository
	uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false

	- name: Setup Rust Cache
	uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2

	- name: Setup cargo-rbmt
	uses: ./.github/actions/setup-rbmt

	- name: Generate Fresh Lockfile
	if: ${{ matrix.lockfile == 'Cargo.lock' }}
	shell: bash
	run: cargo generate-lockfile

	- name: Select Lockfile
	if: ${{ matrix.lockfile != 'Cargo.lock' }}
	shell: bash
	run: cp ${{ matrix.lockfile }} Cargo.lock

	- uses: rustsec/audit-check@69366f33c96575abad1ee0dba8212993eecbe998 # v2.0.0
	with:
	token: ${{ secrets.GITHUB_TOKEN }}

	zizmor:
	name: Zizmor
	runs-on: ubuntu-latest

	steps:
	- name: Checkout Repository
	uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false

	- name: Setup cargo-rbmt
	uses: ./.github/actions/setup-rbmt

	- name: Run Zizmor
	run: zizmor .

Navigation Menu