security_audit.yaml

---
name: Daily Security Audit

on:
  schedule:
    # Run every day at 04:15 UTC: https://crontab.guru/#15_4_*_*_*
    - cron: '15 4 * * *'
  workflow_dispatch:

# rustsec/audit-check reports findings by opening a GitHub issue, and records a
# check run. With contents:read alone it cannot do either, so a new advisory
# would fail silently and the job's green status would mean nothing.
permissions:
  contents: read
  issues: write
  checks: write

jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          token: ${{ secrets.GITHUB_TOKEN }}

      # rustsec/audit-check looks for `cargo-audit` on PATH and falls back to a
      # bare `cargo install cargo-audit` when it is missing. That fallback
      # passes no `--locked`, so it resolves cargo-audit's dependencies fresh
      # and pulls in whatever versions are current, several of which now
      # require a newer rustc than the 1.95.0 that rust-toolchain.toml pins for
      # this repository. Installing a prebuilt binary first satisfies the PATH
      # lookup, so the action never compiles cargo-audit and the pin no longer
      # constrains a tool that only ever reads Cargo.lock.
      - name: Install cargo-audit
        uses: taiki-e/install-action@97a5807a604e12de3a13b52d868ebecaeeea757c # v2.75.4
        with:
          tool: cargo-audit

      - uses: rustsec/audit-check@69366f33c96575abad1ee0dba8212993eecbe998 # v2.0.0
        with:
          token: ${{ secrets.GITHUB_TOKEN }}