name: Security audit

# Daily RustSec coverage (#232).
#
# check-rust.yml runs on PRs that change src-tauri/ and once a week on main,
# and its cargo audit step never fails the job — without this workflow a new
# advisory published against an unchanged dependency would go unnoticed.
#
# Runs without a Rust toolchain: cargo-audit only reads Cargo.lock, so the
# binary is invoked directly instead of as a `cargo` subcommand. That keeps
# this to ~1 min, where a daily check-rust would hold the capacity-1 runner
# for several minutes.
#
# Note: PATH is deliberately NOT overridden at job level (unlike check-rust,
# which needs /root/.cargo/bin for the toolchain) so that the install dir
# taiki-e/install-action appends to $GITHUB_PATH stays effective.
#
# This job reads .cargo/audit.toml from the checkout root, which lists the
# advisories accepted for this project (#310). A green run therefore means "no
# advisory outside that list", not "no advisory at all" — the justification and
# the removal criteria for each entry live in that file, and the policy behind
# it in docs/adr/0018-suppression-advisories-non-atteignables.md.

on:
  schedule:
    # 06:00 UTC daily
    - cron: '0 6 * * *'
  workflow_dispatch:

# What this key does on Forgejo 8.0.3: see the comment on `concurrency` in
# check-rust.yml (#376). That measurement covers push and pull_request runs;
# this workflow only runs on schedule and workflow_dispatch, which it does
# not cover.
concurrency:
  group: ci-audit-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  audit:
    runs-on: ubuntu
    container: ubuntu:22.04
    steps:
      - name: Install Node.js 24
        run: |
          apt-get update
          apt-get install -y --no-install-recommends \
            curl ca-certificates git tar gzip
          # Node.js is required by actions/checkout, a JavaScript action that
          # needs `node` in the container PATH (taiki-e/install-action is a
          # composite action).
          curl -fsSL https://deb.nodesource.com/setup_24.x | bash -
          apt-get install -y nodejs
          node --version

      - name: Checkout
        uses: https://github.com/actions/checkout@v4

      - name: Install cargo-audit
        uses: https://github.com/taiki-e/install-action@v2
        with:
          tool: cargo-audit

      # Unlike the PR run in check-rust.yml, this one is meant to fail loudly:
      # it IS the notification channel for a newly published advisory.
      - name: cargo audit
        run: cargo-audit audit --file src-tauri/Cargo.lock