v4 allows for "tokenless uploads" when users submit pull requests
from their own forks of LNDK. This allows outside contributors to the
project to run the action successfully.
Encourage the use of `cargo-crev` for auditing dependencies. Crev uses
a web of trust of entities contributing reviews of crates within the
Rust ecosystem in this case. Read more at https://github.com/crev-dev/cargo-crev
and see similar use for `rust-bitcoin` at https://github.com/rust-bitcoin/rust-bitcoin/pull/1098.
This commit also adds a GitHub Action for PRs which runs `cargo-audit` to check
dependencies for any known vulnerabilities along with their severity
and steps to remedy. This should be less noisy than dependabot PRs but we
can maybe consider that if we feel it's also helpful to keep track of
dependency updates.
Work is part of #38.
Uses the cargo action to:
- build a release artifact
- run all tests and benches
- requires Cargo.lock and cache file up to date
- run rustfmt in 'check' mode to verify formatting is standard
- run clippy, and fail on warnings
