Audit Rust and npm dependencies in CI #1

	name: Security audit
	on:
	push:
	branches: [main]
	pull_request:
	# Advisories are published against unchanged dependencies too, so audit main weekly.
	schedule:
	- cron: "17 6 * * 1"
	workflow_dispatch:
	permissions:
	contents: read
	concurrency:
	group: security-audit-${{ github.event_name }}-${{ github.ref }}
	cancel-in-progress: ${{ github.event_name == 'pull_request' }}
	jobs:
	# Fails on any known vulnerability in the locked dependencies. RustSec "unmaintained" and
	# "unsound" notices are reported as warnings only; today's come from Tauri's GTK stack.
	cargo-audit:
	runs-on: ubuntu-24.04
	timeout-minutes: 15
	steps:
	- uses: actions/checkout@v4
	- uses: dtolnay/rust-toolchain@stable
	- run: cargo install cargo-audit --version 0.22.2 --locked
	- run: cargo audit --file src-tauri/Cargo.lock

	npm-audit:
	runs-on: ubuntu-24.04
	timeout-minutes: 10
	steps:
	- uses: actions/checkout@v4
	- uses: actions/setup-node@v4
	with:
	node-version: "22.23.2"
	- run: npm audit

Navigation Menu