name: Cargo Audit

on:
  push:
    branches: [main]
    paths:
      - "apps/desktop/src-tauri/**"
      - ".github/workflows/cargo-audit.yml"
      - "!**/*.md"
      - "!**/*.mdx"
      - "!**/*.markdown"
  pull_request:
    branches: [main]
    paths:
      - "apps/desktop/src-tauri/**"
      - ".github/workflows/cargo-audit.yml"
      - "!**/*.md"
      - "!**/*.mdx"
      - "!**/*.markdown"
  schedule:
    # Run weekly on Mondays at 06:00 UTC to catch newly published advisories
    # even when no Cargo files have changed.
    - cron: "0 6 * * 1"

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

# Least-privilege: only reads source; no PR/issue writes or release ops.
permissions:
  contents: read

jobs:
  audit:
    name: Cargo Audit
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: apps/desktop/src-tauri

    steps:
      - name: Checkout code
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          persist-credentials: false

      - name: Install Rust stable
        uses: dtolnay/rust-toolchain@67ef31d5b988238dd797d409d6f9574278e20537 # master
        with:
          toolchain: stable

      - name: Cache cargo registry
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: |
            ~/.cargo/registry/index/
            ~/.cargo/registry/cache/
            ~/.cargo/git/db/
          key: cargo-audit-${{ runner.os }}-${{ hashFiles('apps/desktop/src-tauri/Cargo.lock') }}
          restore-keys: cargo-audit-${{ runner.os }}-

      - name: Install cargo-audit
        run: cargo install cargo-audit --version 0.22.2 --locked

      - name: Run cargo audit
        run: cargo audit