openobserve/.github/workflows/audit-checker.yml

name: Security audit
on:
  # Advisories only matter when the dependency set changes, so PR runs are path-filtered to the
  # Cargo manifests; the weekly run catches advisories published against unchanged deps.
  pull_request:
    types: [opened, reopened, synchronize, labeled, unlabeled, ready_for_review, converted_to_draft]
    paths:
      - "**/Cargo.toml"
      - "**/Cargo.lock"
      - ".github/workflows/audit-checker.yml"
  schedule:
    - cron: "0 3 * * 1"
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  security_audit:
    # Nothing runs on a PR without the 'ready-for-ci' label, or on a draft; ci-gate alone reports the state.
    if: ${{ github.event_name != 'pull_request' || (contains(github.event.pull_request.labels.*.name, 'ready-for-ci') && github.event.pull_request.draft == false) }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - uses: ./.github/actions/github-auth
      - uses: taiki-e/install-action@1e29709c0ec63babbe8f266397a465f29a825f91 # v2.87.31
        env:
          GITHUB_TOKEN: ${{ github.token }}
        with:
          tool: cargo-audit
      - name: run cargo audit
        run: cargo audit