Harden durable settlement journal conformance #86
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Cargo Audit | |
| # Rust supply-chain coverage via RustSec advisory database. Fills the gap | |
| # that CodeQL leaves — CodeQL has no Rust analyzer, so default-setup runs | |
| # but produces no findings regardless of what's in Cargo.lock. cargo-audit | |
| # is the ecosystem-standard check against rustsec/advisory-db. | |
| # | |
| # Triggers: | |
| # - Cargo.lock / Cargo.toml changes on PRs: catches new vulnerable deps | |
| # before merge. | |
| # - Push to main with the same path filter: belt-and-suspenders if an | |
| # admin bypass lands a direct push. | |
| # - Weekly schedule: catches newly-announced CVEs against an unchanged | |
| # Cargo.lock. This is the most valuable trigger — most Rust supply-chain | |
| # alerts come from advisories published after the code was written. | |
| # - workflow_dispatch: manual re-check. | |
| on: | |
| pull_request: | |
| paths: | |
| - 'Cargo.lock' | |
| - 'Cargo.toml' | |
| - '.github/workflows/cargo-audit.yml' | |
| push: | |
| branches: [main, master] | |
| paths: | |
| - 'Cargo.lock' | |
| - 'Cargo.toml' | |
| schedule: | |
| - cron: '0 6 * * 1' # Mondays 06:00 UTC | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| audit: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable @ 2026-05-02 | |
| # taiki-e/install-action fetches a pre-built cargo-audit binary, | |
| # ~5s instead of the ~90s a `cargo install --locked cargo-audit` | |
| # takes from source. Matters for the weekly cron — keeps the | |
| # run cheap enough to not matter. | |
| - name: Install cargo-audit | |
| uses: taiki-e/install-action@afea7909ea88a333ce55be12cacc66fde3989e55 # cargo-audit | |
| - name: Run cargo audit | |
| run: cargo audit --deny warnings |