security_audit.yml

name: Security Audit (advisories, sources)
permissions:
  contents: read
  issues: write

on:
  push:
    # Check immediately if dependencies are altered
    paths:
      - "**/Cargo.toml"
    # Check also at midnight each day
  schedule:
    - cron: "0 0 * * *"

jobs:
  cargo-deny:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        checks:
          - advisories
          - bans sources

    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
        with:
          persist-credentials: false

      - uses: EmbarkStudios/cargo-deny-action@8371184bd11e21dcf8ac82ebf8c9c9f74ebf7268
        with:
          command: check ${{ matrix.checks }}