security.yml

name: Security

on:
  push:
    branches: [main]
  schedule:
    - cron: '0 6 * * 1'

jobs:
  audit:
    name: Cargo Audit
    runs-on: ubuntu-latest
    permissions:
      checks: write
      contents: read
    steps:
      - uses: actions/checkout@v4
      - uses: rustsec/audit-check@v2
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          # RUSTSEC-2023-0071: rsa Marvin Attack timing sidechannel.
          # No fix available. Enters via sqlx-macros-core -> sqlx-mysql which
          # sqlx's proc-macro crate pulls unconditionally regardless of features.
          # Forge never performs RSA operations; rsa is never invoked at runtime.
          # Revisit when sqlx gates sqlx-mysql behind a feature flag.
          #
          # RUSTSEC-2026-0097: rand unsoundness via custom logger + rand::rng().
          # No patched version exists for rand 0.8.x or 0.9.x. rand is a purely
          # transitive dependency; Forge defines no custom logger that accesses
          # rand::rng(), so the unsoundness preconditions are not met.
          # Remove when a patched rand version is released.
          ignore: RUSTSEC-2023-0071,RUSTSEC-2026-0097

  codeql:
    name: CodeQL
    runs-on: ubuntu-latest
    permissions:
      security-events: write
    steps:
      - uses: actions/checkout@v4
      - uses: github/codeql-action/init@v3
        with:
          languages: rust
      - uses: github/codeql-action/autobuild@v3
      - uses: github/codeql-action/analyze@v3