# This workflow audits the Rust dependencies in crates/ for known security
# advisories using cargo-audit. It runs on a weekly schedule, whenever the
# dependency graph changes (Cargo.lock / Cargo.toml), and on demand. On a
# scheduled run, a failure opens a tracking issue (matching the clang-tidy
# workflow's behavior); on push/PR it simply fails the check.
name: Cargo audit

on:
  schedule:
    # 06:32 UTC every Monday.
    - cron: "32 6 * * 1"
  push:
    branches:
      - "develop"
      - "release*"
    paths:
      - "crates/**/Cargo.toml"
      - "crates/Cargo.lock"
      - ".github/workflows/cargo-audit.yml"
  pull_request:
    paths:
      - "crates/**/Cargo.toml"
      - "crates/Cargo.lock"
      - ".github/workflows/cargo-audit.yml"
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

defaults:
  run:
    shell: bash
    working-directory: crates

permissions:
  contents: read

jobs:
  audit:
    runs-on: ubuntu-latest
    container: ghcr.io/xrplf/xrpld/nix-debian:sha-fe4c8ae
    permissions:
      contents: read
      # Needed to open an issue on scheduled failures.
      issues: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

      - name: Install cargo-audit
        uses: taiki-e/install-action@b8cecb83565409bcc297b2df6e77f030b2a468d5 # v2.82.0
        with:
          tool: cargo-audit

      - name: Run cargo audit
        id: audit
        continue-on-error: true
        run: |
          set -o pipefail
          cargo audit | tee /tmp/cargo-audit.txt

      - name: Prepare issue body
        if: ${{ steps.audit.outcome != 'success' && github.event_name == 'schedule' }}
        run: |
          {
            echo "## \`cargo audit\` found advisories"
            echo
            echo '```'
            cat /tmp/cargo-audit.txt
            echo '```'
            echo
            echo "---"
            echo "*This issue was automatically created by the cargo-audit workflow.*"
          } >/tmp/cargo-audit-issue.md

      - name: Create issue
        if: ${{ steps.audit.outcome != 'success' && github.event_name == 'schedule' }}
        uses: XRPLF/actions/create-issue@2b8bc36af85b88bca0dd7bfac2e2dc05f94ad712
        with:
          title: "cargo audit found vulnerabilities"
          body_file: /tmp/cargo-audit-issue.md
          labels: "Bug,Security"

      - name: Fail if advisories were found
        if: ${{ steps.audit.outcome != 'success' }}
        run: |
          echo "cargo audit found advisories!"
          exit 1