fix(ci): run Rust audit from crate

Author: chh-ay

.github/workflows/ci.yml

@@ -63,10 +63,19 @@ jobs:
         run: bun run check:cycles
       - name: JavaScript dependency audit
         run: bun run audit:js
-      - name: Install and run Rust dependency audit
-        run: |
-          cargo install cargo-audit --version "$CARGO_AUDIT_VERSION" --locked
-          cargo audit --manifest-path packages/wasm/Cargo.toml
+      - name: Cache cargo-audit
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        with:
+          path: |
+            ~/.cargo/bin/cargo-audit
+            ~/.cargo/registry
+            ~/.cargo/git
+          key: cargo-audit-${{ runner.os }}-${{ env.RUST_VERSION }}-${{ env.CARGO_AUDIT_VERSION }}
+      - name: Install cargo-audit
+        run: cargo install cargo-audit --version "$CARGO_AUDIT_VERSION" --locked
+      - name: Rust dependency audit
+        working-directory: packages/wasm
+        run: cargo audit
       - name: Lint
         run: bun run lint
 

scripts/toolchain-contract.test.ts

@@ -41,6 +41,7 @@ const EXPECTED_ACTION_PINS: Readonly<Record<string, string>> = {
   "oven-sh/setup-bun": "735343b667d3e6f658f44d0eca948eb6282f2b76",
   "actions/upload-artifact": "ea165f8d65b6e75b540449e92b4886f43607fa02",
   "actions/download-artifact": "634f93cb2916e3fdff6788551b99b062d0335ce0",
+  "actions/cache": "0057852bfaa89a56745cba8c7296529d2fc39830",
 };
 
 function commandOutput(command: readonly [string, ...string[]]): string {