chore(ci): bump taiki-e/install-action from 2.85.13 to 2.87.0 in the actions group #64
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Security audit | |
| # Scan third-party dependencies for known vulnerabilities (RustSec for crates, | |
| # the npm advisory DB for the bun frontend). Runs weekly (catch newly-disclosed | |
| # CVEs in unchanged deps), on every PR/push that touches a manifest or lockfile, | |
| # and on demand. By default only *vulnerabilities* fail the job; advisory | |
| # warnings (e.g. unmaintained crates) are reported but non-blocking. | |
| on: | |
| schedule: | |
| - cron: "0 5 * * 1" # Monday 05:00 UTC | |
| workflow_dispatch: | |
| push: | |
| branches: [main] | |
| paths: | |
| - "src-tauri/Cargo.toml" | |
| - "src-tauri/Cargo.lock" | |
| - "package.json" | |
| - "bun.lock" | |
| - ".github/workflows/security-audit.yml" | |
| pull_request: | |
| paths: | |
| - "src-tauri/Cargo.toml" | |
| - "src-tauri/Cargo.lock" | |
| - "package.json" | |
| - "bun.lock" | |
| - ".github/workflows/security-audit.yml" | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: security-audit-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| cargo-audit: | |
| name: cargo audit (RustSec) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: dtolnay/rust-toolchain@stable | |
| - uses: taiki-e/install-action@v2.87.0 | |
| with: | |
| tool: cargo-audit | |
| # Fails on vulnerabilities; unmaintained/unsound are warnings (non-fatal). | |
| # | |
| # Ignored (vetted) advisories — both are quick-xml <0.41 DoS bugs. The | |
| # runtime path (plist) is fixed by using quick-xml 0.41. The only remaining | |
| # 0.39.x copy comes from `wayland-scanner`, a BUILD-TIME proc-macro that | |
| # parses trusted Wayland protocol XML at compile time and is NOT shipped in | |
| # the binary — no runtime attack surface. Remove these once the | |
| # wayland-rs / wl-clipboard-rs stack (pinned via arboard) moves to 0.41. | |
| - name: cargo audit | |
| run: > | |
| cargo audit --file src-tauri/Cargo.lock | |
| --ignore RUSTSEC-2026-0194 | |
| --ignore RUSTSEC-2026-0195 | |
| bun-audit: | |
| name: bun audit (npm advisories) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: oven-sh/setup-bun@v2 | |
| - run: bun install --frozen-lockfile | |
| - name: bun audit | |
| run: bun audit |