Repository navigation

Pin workflow actions to commit SHAs and configure Dependabot #3

	name: Security audit
	on:
	push:
	branches: [main]
	pull_request:
	# Advisories are published against unchanged dependencies too, so audit main weekly.
	schedule:
	- cron: "17 6 * * 1"
	workflow_dispatch:
	permissions:
	contents: read
	concurrency:
	group: security-audit-${{ github.event_name }}-${{ github.ref }}
	cancel-in-progress: ${{ github.event_name == 'pull_request' }}
	jobs:
	# Fails on any known vulnerability in the locked dependencies. RustSec "unmaintained" and
	# "unsound" notices are reported as warnings only; today's come from Tauri's GTK stack.
	cargo-audit:
	runs-on: ubuntu-24.04
	timeout-minutes: 15
	steps:
	- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
	- uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable
	with:
	toolchain: stable
	- run: cargo install cargo-audit --version 0.22.2 --locked
	- run: cargo audit --file src-tauri/Cargo.lock

	npm-audit:
	runs-on: ubuntu-24.04
	timeout-minutes: 10
	steps:
	- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
	- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
	with:
	node-version: "22.23.2"
	- run: npm audit