cranelift/.github/workflows/cargo-audit.yml

name: Run cargo-audit
on:
  schedule:
    - cron: '0 0 * * *'
jobs:
  security_audit:
    if: github.repository == 'bytecodealliance/wasmtime'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: true
      - uses: rustsec/audit-check@v1.4.1
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
        # This seems to hit rate limits about 50% of the time, unclear why, but
        # emailing us once every few days is not the most useful thing.
        continue-on-error: true
Change how security advisories work on CI (#3461) Before this commit we actually have two builders checking for security advisories on CI, one is `cargo audit` and one is `cargo deny`. The `cargo deny` builder is slightly different in that it checks a few other things about our dependency tree such as licenses, duplicates, etc. This commit removes the advisory check from `cargo deny` on CI and then moves the `cargo audit` check to a separate workflow. The `cargo audit` check will now run nightly and will open an issue on the Wasmtime repository when an advisory is found. This should help make it such that our CI is never broken by the publication of an advisory but we're still promptly notified whenever an advisory is made. I've updated the release process notes to indicate that the open issues should be double-checked to ensure that there are no open advisories that we need to take care of. 3 years ago			`name: Run cargo-audit`
			`on:`
			`schedule:`
			`- cron: '0 0 * * *'`
			`jobs:`
			`security_audit:`
Skip running miri and cargo-audit on forks (#6442) 1 year ago			`if: github.repository == 'bytecodealliance/wasmtime'`
Change how security advisories work on CI (#3461) Before this commit we actually have two builders checking for security advisories on CI, one is `cargo audit` and one is `cargo deny`. The `cargo deny` builder is slightly different in that it checks a few other things about our dependency tree such as licenses, duplicates, etc. This commit removes the advisory check from `cargo deny` on CI and then moves the `cargo audit` check to a separate workflow. The `cargo audit` check will now run nightly and will open an issue on the Wasmtime repository when an advisory is found. This should help make it such that our CI is never broken by the publication of an advisory but we're still promptly notified whenever an advisory is made. I've updated the release process notes to indicate that the open issues should be double-checked to ensure that there are no open advisories that we need to take care of. 3 years ago			`runs-on: ubuntu-latest`
			`steps:`
ci: Update to `actions/checkout@v4` from `v3`. (#7674) This mainly updates to use Node 20 rather than Node 16 internally. 11 months ago			`- uses: actions/checkout@v4`
Checkout submodules in cargo audit CI (#3463) This should help address the failure that happened last night. https://github.com/bytecodealliance/wasmtime/actions/runs/1361422923 3 years ago			`with:`
			`submodules: true`
Update location of cargo-audit CI check (#8184) I believe the actions-rs is mostly sunsetted now, so use the one recommended in [cargo-audit's README][readme] [readme]: https://github.com/RustSec/rustsec/tree/main/cargo-audit 8 months ago			`- uses: rustsec/audit-check@v1.4.1`
Change how security advisories work on CI (#3461) Before this commit we actually have two builders checking for security advisories on CI, one is `cargo audit` and one is `cargo deny`. The `cargo deny` builder is slightly different in that it checks a few other things about our dependency tree such as licenses, duplicates, etc. This commit removes the advisory check from `cargo deny` on CI and then moves the `cargo audit` check to a separate workflow. The `cargo audit` check will now run nightly and will open an issue on the Wasmtime repository when an advisory is found. This should help make it such that our CI is never broken by the publication of an advisory but we're still promptly notified whenever an advisory is made. I've updated the release process notes to indicate that the open issues should be double-checked to ensure that there are no open advisories that we need to take care of. 3 years ago			`with:`
			`token: ${{ secrets.GITHUB_TOKEN }}`
Allow cargo-audit workflow to fail (#8280) Currently this workflow fails about 50% of the time due to what appears to be rate limiting issues. I'm personally receiving emails every time this fails and would rather not continue to receive emails. I've updated this to allow failure to hopefully stop notifying me about this. 7 months ago			`# This seems to hit rate limits about 50% of the time, unclear why, but`
			`# emailing us once every few days is not the most useful thing.`
			`continue-on-error: true`