chore(security): remediate cargo-deny and cargo-audit failures (#12) #32

	name: Security Audit

	on:
	push:
	branches: [main]
	paths:
	- "**/Cargo.toml"
	- "**/Cargo.lock"
	- "deny.toml"
	pull_request:
	paths:
	- "**/Cargo.toml"
	- "**/Cargo.lock"
	- "deny.toml"
	schedule:
	# Monday at 6am UTC
	- cron: "0 6 * * 1"
	workflow_dispatch:

	jobs:
	cargo-audit:
	name: cargo audit
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	- uses: dtolnay/rust-toolchain@stable
	- name: Install cargo-audit
	run: cargo install cargo-audit --locked
	- name: Run cargo audit
	run: cargo audit

	cargo-deny:
	name: cargo deny (${{ matrix.check }})
	runs-on: ubuntu-latest
	strategy:
	matrix:
	check: [advisories, licenses, bans, sources]
	steps:
	- uses: actions/checkout@v4
	- uses: EmbarkStudios/cargo-deny-action@v2
	with:
	command: check ${{ matrix.check }}

	sbom:
	name: SBOM generation
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	- uses: dtolnay/rust-toolchain@stable
	- name: Install cargo-cyclonedx
	run: cargo install cargo-cyclonedx --locked
	- name: Generate SBOM
	run: cargo cyclonedx --manifest-path Cargo.toml --format json --all
	- name: Upload SBOM artifacts
	uses: actions/upload-artifact@v4
	with:
	name: sbom
	path: "**/bom.json"
	retention-days: 90

Navigation Menu