name: Security

on:
  push:
    branches: [main]
  pull_request:
  schedule:
    - cron: "17 4 * * 1"
  workflow_dispatch:

concurrency:
  group: security-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

env:
  CARGO_TERM_COLOR: always

jobs:
  cargo-audit:
    name: RustSec cargo-audit
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      - name: Cache Cargo
        uses: Swatinem/rust-cache@v2

      - name: Install cargo-audit
        uses: taiki-e/install-action@cargo-audit

      - name: Scan Cargo.lock for advisories
        run: cargo audit --deny warnings