security: finalize v0.9.0 pentest report #37
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Rust CI | |
| on: | |
| push: | |
| branches: | |
| - main | |
| pull_request: | |
| branches: | |
| - main | |
| permissions: | |
| contents: read | |
| env: | |
| CARGO_TERM_COLOR: always | |
| jobs: | |
| checks: | |
| name: Format, lint, test, and audit | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 45 | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Install Rust toolchain | |
| run: rustup show | |
| - name: Install security tools | |
| run: | | |
| cargo install --locked cargo-deny --version 0.19.9 | |
| cargo install --locked cargo-audit --version 0.22.2 | |
| - name: Install SBOM tool | |
| run: cargo install --locked cargo-sbom --version 0.10.0 | |
| - name: Run local check gate | |
| run: scripts/checks.sh | |
| - name: Check dependency policy | |
| run: cargo deny check | |
| - name: Check RustSec advisories | |
| run: cargo audit | |
| - name: Generate SBOM | |
| run: scripts/generate-sbom.sh |