name: Security Audit

on:
  push:
    branches: [ main, master ]
  pull_request:
    branches: [ main, master ]
  schedule:
    # Run security audit daily at 2 AM UTC
    - cron: '0 2 * * *'

jobs:
  security_audit:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout sources
        uses: actions/checkout@v4

      - name: Install stable toolchain
        uses: actions-rust-lang/setup-rust-toolchain@v1

      - name: Cache cargo-audit
        uses: actions/cache@v4
        id: cache-audit
        with:
          path: ~/.cargo/bin/cargo-audit
          key: cargo-audit-${{ runner.os }}

      - name: Install cargo-audit
        if: steps.cache-audit.outputs.cache-hit != 'true'
        run: cargo install cargo-audit

      - name: Run security audit
        run: cargo audit

  dependency_check:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout sources
        uses: actions/checkout@v4

      - name: Install stable toolchain
        uses: actions-rust-lang/setup-rust-toolchain@v1

      - name: Cache cargo-machete
        uses: actions/cache@v4
        id: cache-machete
        with:
          path: ~/.cargo/bin/cargo-machete
          key: cargo-machete-${{ runner.os }}

      - name: Install cargo-machete
        if: steps.cache-machete.outputs.cache-hit != 'true'
        run: cargo install cargo-machete

      - name: Check for unused dependencies
        run: cargo machete