Run cargo audit as part of CI builds

[anderejd]

cargo audit exists and we should use it as part of CI builds:

[brightly-salty]

This can be easily accomplished by using this GitHub action.

[anderejd]

Excuse my ignorance, I need to study GitHub Actions... the linked GitHub action looks over-engineered and seems to depend on nodejs. Why is that better than a single command cargo audit? Is it how GitHub actions must be implemented?

[brightly-salty]

I probably know even less than you. I do know that cargo-audit recommends using that GitHub Action rather than running cargo audit directly here.

[tarcieri]

There's some functionality in the action which is nice, like auto-filing issues for security vulnerabilities.

If you don't care about that you can just use a simple action which installs, caches, and runs cargo-audit, although that won't change anything about using Node since that's what Actions is using behind the scenes.

[anderejd]

cargo-audit recommends using that GitHub Action rather than running cargo audit directly here

@brightly-salty Thanks for the link and the info, let's go with the official recommendation and use the GitHub action.

There's some functionality in the action which is nice, like auto-filing issues for security vulnerabilities.

If you don't care about that you can just use a simple action which installs, caches, and runs cargo-audit, although that won't change anything about using Node since that's what Actions is using behind the scenes.

@tarcieri If nodejs is what GitHub Actions require, then I have no problem with it, I just prefer to avoid nodejs when possible. Let's use the mentioned GitHub action.

[jmcconnell26]

Raised #184 to run cargo audit against head at midnight

[anderejd]

Great work, thanks! Closing.