Add cargo audit to CI workflow

.cargo/audit.toml

@@ -0,0 +1,45 @@
+# Example audit config file
+#
+# It may be located in the user home (`~/.cargo/audit.toml`) or in the project
+# root (`.cargo/audit.toml`).
+#
+# All of the options which can be passed via CLI arguments can also be
+# permanently specified in this file.
+
+# Crate:     rsa
+# Version:   0.9.10
+# Title:     Marvin Attack: potential key recovery through timing sidechannels
+# Date:      2023-11-22
+# ID:        RUSTSEC-2023-0071
+# URL:       https://rustsec.org/advisories/RUSTSEC-2023-0071
+# Severity:  5.9 (medium)
+# Solution:  No fixed upgrade is available!
+# Dependency tree:
+# rsa 0.9.10
+# └── openidconnect 4.0.1
+#     └── numtracker 0.0.0
+
+[advisories]
+ignore = ["RUSTSEC-2023-0071"] # advisory IDs to ignore e.g. ["RUSTSEC-2019-0001", ...]
+
+informational_warnings = ["unmaintained"] # warn for categories of informational advisories
+severity_threshold = "low" # CVSS severity ("none", "low", "medium", "high", "critical")
+
+# Advisory Database Configuration
+[database]
+path = "~/.cargo/advisory-db" # Path where advisory git repo will be cloned
+url = "https://github.com/RustSec/advisory-db.git" # URL to git repo
+fetch = true # Perform a `git fetch` before auditing (default: true)
+stale = false # Allow stale advisory DB (i.e. no commits for 90 days, default: false)
+
+# Output Configuration
+[output]
+deny = ["unmaintained"] # exit on error if unmaintained dependencies are found
+format = "terminal" # "terminal" (human readable report) or "json"
+quiet = false # Only print information on error
+
+
+# Target Configuration
+[target]
+arch = ["x86_64"] # Ignore advisories for CPU architectures other than these
+os = ["linux"] # Ignore advisories for operating systems other than these

.github/workflows/cargo_audit.yml

@@ -0,0 +1,20 @@
+name: Cargo lock check
+
+on:
+  workflow_call:
+  push:
+    paths: 
+      - '**/Cargo.toml'
+      - '**/Cargo.lock'
+
+jobs:
+  security_audit:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Audit Cargo.lock for security advisories
+        uses: rustsec/audit-check@v2.0.0
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/periodic.yml

@@ -0,0 +1,15 @@
+name: Periodic
+
+on:
+  workflow_dispatch:
+  schedule:
+    # Run weekly to check for new vulnerabilities
+    - cron: "0 8 * * WED"
+
+jobs:
+
+  cargo_audit:
+    uses: ./.github/workflows/cargo_audit.yml
+    permissions:
+      issues: write
+      checks: write