119625d8cSopenharmony_ciname: Security audit
219625d8cSopenharmony_ci
319625d8cSopenharmony_cipermissions:
419625d8cSopenharmony_ci  contents: read
519625d8cSopenharmony_ci
619625d8cSopenharmony_cion:
719625d8cSopenharmony_ci  pull_request:
819625d8cSopenharmony_ci    paths:
919625d8cSopenharmony_ci      - '**/Cargo.toml'
1019625d8cSopenharmony_ci      - '**/Cargo.lock'
1119625d8cSopenharmony_ci  push:
1219625d8cSopenharmony_ci    branches:
1319625d8cSopenharmony_ci    - main
1419625d8cSopenharmony_ci
1519625d8cSopenharmony_cienv:
1619625d8cSopenharmony_ci  RUST_BACKTRACE: 1
1719625d8cSopenharmony_ci  CARGO_TERM_COLOR: always
1819625d8cSopenharmony_ci  CLICOLOR: 1
1919625d8cSopenharmony_ci
2019625d8cSopenharmony_cijobs:
2119625d8cSopenharmony_ci  security_audit:
2219625d8cSopenharmony_ci    permissions:
2319625d8cSopenharmony_ci      issues: write # to create issues (actions-rs/audit-check)
2419625d8cSopenharmony_ci      checks: write # to create check (actions-rs/audit-check)
2519625d8cSopenharmony_ci    runs-on: ubuntu-latest
2619625d8cSopenharmony_ci    # Prevent sudden announcement of a new advisory from failing ci:
2719625d8cSopenharmony_ci    continue-on-error: true
2819625d8cSopenharmony_ci    steps:
2919625d8cSopenharmony_ci    - name: Checkout repository
3019625d8cSopenharmony_ci      uses: actions/checkout@v3
3119625d8cSopenharmony_ci    - uses: actions-rs/audit-check@v1
3219625d8cSopenharmony_ci      with:
3319625d8cSopenharmony_ci        token: ${{ secrets.GITHUB_TOKEN }}
3419625d8cSopenharmony_ci
3519625d8cSopenharmony_ci  cargo_deny:
3619625d8cSopenharmony_ci    permissions:
3719625d8cSopenharmony_ci      issues: write # to create issues (actions-rs/audit-check)
3819625d8cSopenharmony_ci      checks: write # to create check (actions-rs/audit-check)
3919625d8cSopenharmony_ci    runs-on: ubuntu-latest
4019625d8cSopenharmony_ci    strategy:
4119625d8cSopenharmony_ci      matrix:
4219625d8cSopenharmony_ci        checks:
4319625d8cSopenharmony_ci          - bans licenses sources
4419625d8cSopenharmony_ci    steps:
4519625d8cSopenharmony_ci    - uses: actions/checkout@v3
4619625d8cSopenharmony_ci    - uses: EmbarkStudios/cargo-deny-action@v1
4719625d8cSopenharmony_ci      with:
4819625d8cSopenharmony_ci        command: check ${{ matrix.checks }}
4919625d8cSopenharmony_ci        rust-version: stable
50