security-audit.yml

name: Security audit
on:
  push:
    branches: [main]
  pull_request:
  # Advisories are published against unchanged dependencies too, so audit main weekly.
  schedule:
    - cron: "17 6 * * 1"
  workflow_dispatch:
permissions:
  contents: read
concurrency:
  group: security-audit-${{ github.event_name }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
jobs:
  # Fails on any known vulnerability in the locked dependencies. RustSec "unmaintained" and
  # "unsound" notices are reported as warnings only; today's come from Tauri's GTK stack.
  cargo-audit:
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable
        with:
          toolchain: stable
      - run: cargo install cargo-audit --version 0.22.2 --locked
      - run: cargo audit --file src-tauri/Cargo.lock

  npm-audit:
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: "22.23.2"
      - run: npm audit