audit.yml

name: Security audit
on:
  push:
    paths: 
      - '**/Cargo.toml'
      - '**/Cargo.lock'

permissions:
  issues: write
  checks: write
  contents: read

jobs:
  security_audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Cache dependencies
        uses: Swatinem/rust-cache@23bce251a8cd2ffc3c1075eaa2367cf899916d84 #v2.7.3
        if: ${{ !startsWith(github.head_ref, 'renovate/') }}
      - name: Configure sccache
        run: |
          echo "RUSTC_WRAPPER=sccache" >> $GITHUB_ENV
          echo "SCCACHE_GHA_ENABLED=true" >> $GITHUB_ENV
        if: ${{ !startsWith(github.head_ref, 'renovate/') }}
      - name: Run sccache-cache
        uses: mozilla-actions/sccache-action@89e9040de88b577a072e3760aaf59f585da083af #v0.0.5
        if: ${{ !startsWith(github.head_ref, 'renovate/') }}
      - name: Install Protoc
        uses: arduino/setup-protoc@v3
      - uses: rustsec/audit-check@v1.4.1
        with:
          token: ${{ secrets.GITHUB_TOKEN }}