Audit

Audit #25

	name: Audit

	on:
	push:
	branches: [main]
	paths:
	- "**/Cargo.toml"
	- "**/Cargo.lock"
	- "deny.toml"
	- "contracts/deny.toml"
	- ".github/workflows/audit.yml"
	pull_request:
	branches: [main]
	paths:
	- "**/Cargo.toml"
	- "**/Cargo.lock"
	- "deny.toml"
	- "contracts/deny.toml"
	- ".github/workflows/audit.yml"
	schedule:
	# Weekly re-check so newly published advisories are caught even without a push.
	- cron: "0 6 * * 1"

	env:
	CARGO_TERM_COLOR: always

	jobs:
	cargo-deny:
	name: cargo-deny (advisories, licenses, bans, sources)
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	- uses: EmbarkStudios/cargo-deny-action@v2
	with:
	command: check advisories licenses bans sources

	cargo-audit:
	name: cargo-audit (RustSec)
	runs-on: ubuntu-latest
	# audit-check publica o resultado como um check run; sem checks:write o
	# POST falha com "Resource not accessible by integration" e derruba o job
	# mesmo com o audit limpo.
	permissions:
	contents: read
	checks: write
	issues: write
	steps:
	- uses: actions/checkout@v4
	- uses: rustsec/audit-check@v2
	with:
	token: ${{ secrets.GITHUB_TOKEN }}

	# The escrow program is a SEPARATE workspace (own Cargo.lock) excluded from
	# the root — audit its Solana/Anchor dependency tree explicitly. Uses
	# contracts/deny.toml (ignores the known-unfixable informational advisories,
	# fails on any new one).
	cargo-deny-contracts:
	name: cargo-deny advisories (escrow program)
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	- uses: EmbarkStudios/cargo-deny-action@v2
	with:
	command: check advisories
	manifest-path: contracts/Cargo.toml

Navigation Menu