name: Security Audit

on:
  push:
    branches: [ "main" ]
  pull_request:
    branches: [ "main" ]
  schedule:
    - cron: '0 0 * * 1' # Weekly on Monday

env:
  CARGO_TERM_COLOR: always

jobs:
  audit:
    runs-on: ubuntu-latest

    steps:
    - uses: actions/checkout@v5
      with:
        submodules: recursive

    - name: Install Rust
      uses: dtolnay/rust-toolchain@stable

    - name: Cache cargo registry
      uses: actions/cache@v4
      with:
        path: |
          ~/.cargo/registry
          ~/.cargo/git
        key: ${{ runner.os }}-audit-${{ hashFiles('**/Cargo.lock') }}
        restore-keys: |
          ${{ runner.os }}-audit-

    - name: Install cargo-audit
      uses: taiki-e/install-action@cargo-audit

    - name: Run security audit
      run: cargo audit

  deny:
    name: Cargo Deny
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v5
      with:
        submodules: recursive
    - uses: EmbarkStudios/cargo-deny-action@v2
