mirror of
https://github.com/lndk-org/lndk.git
synced 2026-08-14 12:43:05 +02:00
99dde8cdb5
Encourage the use of `cargo-crev` for auditing dependencies. Crev uses a web of trust of entities contributing reviews of crates within the Rust ecosystem in this case. Read more at https://github.com/crev-dev/cargo-crev and see similar use for `rust-bitcoin` at https://github.com/rust-bitcoin/rust-bitcoin/pull/1098. This commit also adds a GitHub Action for PRs which runs `cargo-audit` to check dependencies for any known vulnerabilities along with their severity and steps to remedy. This should be less noisy than dependabot PRs but we can maybe consider that if we feel it's also helpful to keep track of dependency updates. Work is part of #38.
15 lines
308 B
YAML
15 lines
308 B
YAML
name: Security audit
|
|
|
|
on:
|
|
pull_request:
|
|
paths:
|
|
- '.github/workflows/audit.yml'
|
|
- '**/Cargo.*'
|
|
jobs:
|
|
security_audit:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v1
|
|
- uses: actions-rs/audit-check@v1
|
|
with:
|
|
token: ${{ secrets.GITHUB_TOKEN }}
|