security-audit.yml

name: "Security Audit"

on:
  push:
    branches: [ "main" ]
    paths:
      - "**/Cargo.toml"
      - "**/Cargo.lock"
  pull_request:
    branches: [ "main" ]
    paths:
      - "**/Cargo.toml"
      - "**/Cargo.lock"
  schedule:
    - cron: "30 2 * * 1"

jobs:
  audit:
    name: Cargo Security Audit
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      - name: Cache cargo registry
        uses: actions/cache@v5
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
          key: ${{ runner.os }}-cargo-audit-${{ hashFiles('**/Cargo.lock') }}

      - name: Install cargo-audit
        run: cargo install cargo-audit

      - name: Run security audit
        # RUSTSEC-2023-0071: "Marvin Attack" timing sidechannel in the `rsa`
        # crate.  All versions are affected; no upstream fix exists.  We use
        # `rsa` only for key generation, not for ciphertext decryption, so the
        # timing-based key-recovery attack against RSA decryption does not
        # apply to this codebase.
        run: cargo audit --ignore RUSTSEC-2023-0071

  deny:
    name: Cargo Deny
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Check licenses and bans
        # Advisory DB check is handled by the separate cargo-audit job above.
        # Restricting to licenses + bans avoids breakage when the advisory DB
        # introduces new TOML features unsupported by this pinned cargo-deny
        # version (e.g. RUSTSEC-2026-0076 parse error with cargo-deny 0.14.x).
        uses: EmbarkStudios/cargo-deny-action@v2
        with:
          command: check licenses bans