Tailor CI for Tuwunel. #306

	name: Security Audit

	# Audit the committed lockfile whenever a branch changes. Manual dispatch is
	# available when an advisory needs checking without a source change.
	on:
	push:
	branches:
	- "**"
	workflow_dispatch:

	permissions:
	contents: read

	jobs:
	security-audit:
	name: Security audit
	runs-on: ubuntu-24.04
	timeout-minutes: 10
	steps:
	- uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
	with:
	persist-credentials: false

	- name: Install rust
	uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
	with:
	toolchain: stable
	cache: false
	rustflags: ""

	# No `cargo generate-lockfile` here. Cargo.lock is committed, and
	# regenerating it re-resolves every dependency to the newest compatible
	# version, so the audit would cover versions nobody builds and would miss
	# a vulnerable pin that is actually in the lockfile.
	- name: Audit check
	uses: actions-rust-lang/audit@72c09e02f132669d52284a3323acdb503cfc1a24 # v1.2.7
	with:
	createIssues: false

Navigation Menu