name: "Audit Dependencies"

on:
  push:
    paths:
      # Run if workflow changes
      - ".github/workflows/audit.yml"
      # Run on changed dependencies
      - "**/Cargo.toml"
      - "**/Cargo.lock"
      # Run if the configuration file changes
      - "**/audit.toml"
  pull_request:
    paths:
      # Run if workflow changes
      - ".github/workflows/audit.yml"
      # Run on changed dependencies
      - "**/Cargo.toml"
      - "**/Cargo.lock"
      # Run if the configuration file changes
      - "**/audit.toml"
  # Rerun periodically to pick up new advisories
  schedule:
    - cron: "0 0 * * *"
  # Run manually
  workflow_dispatch:

env:
  CARGO_TERM_COLOR: always

jobs:
  audit:
    name: Audit Dependencies
    runs-on: ubuntu-latest
    environment:
      name: audit
    permissions:
      contents: read
      issues: write
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Setup Rust
        uses: actions-rust-lang/setup-rust-toolchain@v1
        with:
          toolchain: stable
          cache-key: ${{ runner.os }}-stable

      - name: Audit Rust Dependencies
        uses: actions-rust-lang/audit@v1
