jory
4372c7f7c0
- Bump all actions to latest versions (checkout@v6, upload-artifact@v7, download-artifact@v8, labeler@v6, gh-release@v3, gpg-import@v7) - Replace fragile curl|bash tool install with taiki-e/install-action@v2 - Fix Swatinem/rust-cache ordering: must run AFTER toolchain install for correct cache key derivation - Add --all-targets to clippy (CI now matches local testing) - Add RUSTDOCFLAGS=-D warnings to doc step (fail on broken links) - Fix ARM64 build order: install Rust toolchain before adding target and configuring linker - Add rust-toolchain.toml pinning Rust 1.94.0 for deterministic builds - Update Cargo.lock: rustls-webpki v0.103.11->v0.103.13 (fixes 3 CVEs) - Fix softprops/action-gh-release@v3: include checksums in files list (v3 removed the checksum input parameter) - Fix clippy manual_checked_ops lint in screenshot.rs - Clean up trailing whitespace and missing newlines in YAML files
52 lines
1.2 KiB
YAML
52 lines
1.2 KiB
YAML
name: Security Scan
|
|
|
|
on:
|
|
schedule:
|
|
- cron: '0 0 * * 0' # Weekly on Sunday at midnight
|
|
workflow_dispatch: # Manual trigger
|
|
push:
|
|
branches: [main, master]
|
|
paths:
|
|
- 'Cargo.toml'
|
|
- 'Cargo.lock'
|
|
- 'deny.toml'
|
|
- '.github/workflows/security.yml'
|
|
|
|
env:
|
|
CARGO_TERM_COLOR: always
|
|
|
|
jobs:
|
|
security-audit:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v6
|
|
|
|
- name: Install Rust
|
|
uses: dtolnay/rust-toolchain@stable
|
|
|
|
- uses: Swatinem/rust-cache@v2
|
|
|
|
- name: Install security tools
|
|
uses: taiki-e/install-action@v2
|
|
with:
|
|
tool: cargo-audit,cargo-deny,cargo-cyclonedx,cargo-outdated
|
|
|
|
- name: Run cargo audit
|
|
run: cargo audit
|
|
|
|
- name: Run cargo deny
|
|
run: cargo deny check
|
|
|
|
- name: Generate Software Bill of Materials (SBOM)
|
|
run: cargo cyclonedx --format json --override-filename bom
|
|
|
|
- name: Upload SBOM
|
|
uses: actions/upload-artifact@v7
|
|
with:
|
|
name: sbom
|
|
path: bom.json
|
|
|
|
- name: Check for outdated dependencies
|
|
run: cargo outdated --exit-code 1 || echo "Some dependencies are outdated"
|
|
|