audit.yml

name: Security audit

on:
  pull_request:
    paths:
      - '**/Cargo.toml'
      - '**/Cargo.lock'
      - '**.yml'
  schedule:
    # Runs at 00:00 UTC everyday
    - cron: "0 0 * * *"
  push:
    paths:
      - '**/Cargo.toml'
      - '**/Cargo.lock'
      - '**.yml'
  merge_group:
    types: [checks_requested]

concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

jobs:
  audit:
    if: ${{ github.repository_owner == 'rustic-rs' }}
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
      # Ensure that the latest version of Cargo is installed
      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@1482605bfc5719782e1267fd0c0cc350fe7646b8 # v1
        with:
          toolchain: stable
      - uses: Swatinem/rust-cache@82a92a6e8fbeee089604da2575dc567ae9ddeaab # v2

      - name: Generate lockfile (Cargo.lock)
        run: cargo generate-lockfile

      - uses: rustsec/audit-check@69366f33c96575abad1ee0dba8212993eecbe998 # v2.0.0
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          ignore: RUSTSEC-2023-0071  # rsa thingy, ignored for now

  cargo-deny:
    if: ${{ github.repository_owner == 'rustic-rs' }}
    name: Run cargo-deny
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4

      - uses: EmbarkStudios/cargo-deny-action@e2f4ede4a4e60ea15ff31bc0647485d80c66cfba # v2
        with:
          command: check bans licenses sources

  result:
    if: ${{ github.repository_owner == 'rustic-rs' }}
    name: Result (Audit)
    runs-on: ubuntu-latest
    needs:
      - audit
      - cargo-deny
    steps:
      - name: Mark the job as successful
        run: exit 0
        if: success()
      - name: Mark the job as unsuccessful
        run: exit 1
        if: "!success()"