build(deps): bump the actions group across 1 directory with 4 updates #2

	name: Security Audit

	on:
	push:
	branches: [master]
	paths:
	- "**/Cargo.toml"
	- "**/Cargo.lock"
	- "deny.toml"
	- ".github/workflows/security.yml"
	pull_request:
	paths:
	- "**/Cargo.toml"
	- "**/Cargo.lock"
	- "deny.toml"
	- ".github/workflows/security.yml"
	schedule:
	# Run daily at 06:37 UTC to catch newly disclosed advisories
	- cron: "37 6 * * *"
	workflow_dispatch:

	permissions:
	contents: read

	jobs:
	# ── cargo-deny: licenses, bans, sources, advisories ────────────
	cargo-deny:
	name: cargo-deny (${{ matrix.checks }})
	runs-on: ubuntu-latest
	strategy:
	fail-fast: false
	matrix:
	checks:
	- advisories
	- bans licenses sources
	# New upstream advisories should not block PRs
	continue-on-error: ${{ matrix.checks == 'advisories' }}
	steps:
	- uses: actions/checkout@v6
	- uses: EmbarkStudios/cargo-deny-action@v2
	with:
	command: check
	command-arguments: ${{ matrix.checks }}

	# ── cargo-audit: RustSec advisory database scan ────────────────
	cargo-audit:
	name: cargo-audit
	# Skip on fork PRs to avoid arbitrary code execution
	if: >-
	github.event_name != 'pull_request' \|\|
	github.event.pull_request.head.repo.full_name == github.repository
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v6
	- uses: actions-rust-lang/audit@v1

Provide feedback