audit.yml

name: Security audit

on:
  pull_request:
    paths:
      - '**/Cargo.toml'
      - '**/Cargo.lock'
      - '**.yml'
  schedule:
    # Runs at 00:00 UTC everyday
    - cron: "0 0 * * *"
  push:
    paths:
      - '**/Cargo.toml'
      - '**/Cargo.lock'
      - '**.yml'
  merge_group:
    types: [checks_requested]

concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

jobs:
  audit:
    if: ${{ github.repository_owner == 'rustic-rs' }}
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4
      # Ensure that the latest version of Cargo is installed
      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@1482605bfc5719782e1267fd0c0cc350fe7646b8 # v1
        with:
          toolchain: stable
      - uses: Swatinem/rust-cache@82a92a6e8fbeee089604da2575dc567ae9ddeaab # v2

      - name: Generate lockfile (Cargo.lock)
        run: cargo generate-lockfile

      - uses: rustsec/audit-check@69366f33c96575abad1ee0dba8212993eecbe998 # v2.0.0
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          ignore: RUSTSEC-2023-0071  # rsa thingy, ignored for now

  cargo-deny:
    if: ${{ github.repository_owner == 'rustic-rs' }}
    name: Run cargo-deny
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4

      - uses: EmbarkStudios/cargo-deny-action@8371184bd11e21dcf8ac82ebf8c9c9f74ebf7268 # v2
        with:
          command: check bans licenses sources

  result:
    if: ${{ github.repository_owner == 'rustic-rs' }}
    name: Result (Audit)
    runs-on: ubuntu-latest
    needs:
      - audit
      - cargo-deny
    steps:
      - name: Mark the job as successful
        run: exit 0
        if: success()
      - name: Mark the job as unsuccessful
        run: exit 1
        if: "!success()"