name: Security audit

# Daily RustSec coverage (#232).
#
# check-rust.yml only runs when src-tauri/ changes, which is roughly 1 PR in
# 40 — without this workflow a new advisory published against an unchanged
# dependency would go unnoticed for weeks.
#
# Runs without a Rust toolchain: cargo-audit only reads Cargo.lock, so the
# binary is invoked directly instead of as a `cargo` subcommand. That keeps
# this to ~1-2 min rather than the ~22 min a scheduled check-rust would cost
# every day on a capacity-1 runner.
#
# Note: PATH is deliberately NOT overridden at job level (unlike check-rust,
# which needs /root/.cargo/bin for the toolchain) so that the install dir
# taiki-e/install-action appends to $GITHUB_PATH stays effective.
#
# This job reads .cargo/audit.toml from the checkout root, which lists the
# advisories accepted for this project (#310). A green run therefore means "no
# advisory outside that list", not "no advisory at all" — the justification and
# the removal criteria for each entry live in that file, and the policy behind
# it in docs/adr/0018-suppression-advisories-non-atteignables.md.

on:
  schedule:
    # 06:00 UTC daily
    - cron: '0 6 * * *'
  workflow_dispatch:

concurrency:
  group: ci-audit-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  audit:
    runs-on: ubuntu
    container: ubuntu:22.04
    steps:
      - name: Install Node.js 20
        run: |
          apt-get update
          apt-get install -y --no-install-recommends \
            curl ca-certificates git tar gzip
          # Node.js is required by actions/checkout and taiki-e/install-action
          # (JavaScript actions need `node` in the container PATH).
          curl -fsSL https://deb.nodesource.com/setup_20.x | bash -
          apt-get install -y nodejs
          node --version

      - name: Checkout
        uses: https://github.com/actions/checkout@v4

      - name: Install cargo-audit
        uses: https://github.com/taiki-e/install-action@v2
        with:
          tool: cargo-audit

      # Unlike the PR run in check-rust.yml, this one is meant to fail loudly:
      # it IS the notification channel for a newly published advisory.
      - name: cargo audit
        run: cargo-audit audit --file src-tauri/Cargo.lock