security.yml

name: Security Audit

on:
  # Run weekly on Monday at 00:00 UTC
  schedule:
    - cron: "0 0 * * 1"
  # Allow manual trigger
  workflow_dispatch:

env:
  CARGO_TERM_COLOR: always

# Note: Basic security checks (cargo-audit, cargo-deny) now run in CI workflow
# on every push/PR. This workflow focuses on deeper/scheduled checks.

jobs:
  # Check for outdated dependencies
  outdated:
    name: Outdated Dependencies
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - name: Install cargo-outdated
        run: cargo install cargo-outdated --locked
      - name: Check for outdated dependencies
        run: cargo outdated --exit-code 1
        continue-on-error: true  # Informational only

  # Thorough unused dependency check (requires nightly)
  unused-deps-thorough:
    name: Unused Dependencies (thorough)
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@nightly
      - uses: Swatinem/rust-cache@v2
        with:
          cache-on-failure: true
      - name: Install cargo-udeps
        run: cargo install cargo-udeps --locked
      - name: Check for unused dependencies
        run: cargo +nightly udeps --all-features