audit.yml

name: Audit
on:
  pull_request:
  schedule:
    - cron: '0 0 * * *'

jobs:
  dependencies:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Audit dependencies (crates)
        uses: actions-rs/audit-check@v1
        with:
          token: ${{ secrets.GITHUB_TOKEN }}

  security:
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Run DevSkim scanner
        uses: microsoft/DevSkim-Action@v1

      - name: Upload result as build artifact
        uses: actions/upload-artifact@v2
        with: 
          name: devskim-results
          path: devskim-results.sarif   
        
      - name: Upload results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v1
        with:
          sarif_file: devskim-results.sarif          
  
  code-quality:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Install stable toolchain
        uses: actions-rs/toolchain@v1
        with:
          profile: minimal
          toolchain: stable
          override: true
          components: clippy, rustfmt

      - name: Installing dependencies to build `protoc`...
        run: sudo apt-get update && sudo apt-get install -y curl cmake gcc g++ make

      - name: Install `protoc` to compile protobuf files
        run: |
          curl -L https://github.com/protocolbuffers/protobuf/archive/refs/tags/v3.21.11.tar.gz | tar -xz \
          && cd ./protobuf-3.21.11 \
          && cmake -Dprotobuf_BUILD_TESTS=off . \
          && cmake --build . -j $(nproc) \
          && sudo mv $(readlink protoc) /usr/bin/protoc \
          && cd ../ \
          && rm -r ./protobuf-3.21.11

      - name: Run linter (clippy)
        uses: actions-rs/cargo@v1
        with:
          command: clippy
          args: -- -D warnings --allow clippy::manual_range_contains