name: Security Audit

on:
  pull_request:
  schedule:
    - cron: '0 2 * * 1'  # Weekly
  workflow_dispatch:

permissions:
  contents: read

jobs:
  cargo-audit:
    name: Cargo Audit
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - name: Setup Rust
        uses: dtolnay/rust-toolchain@1.90.0
      - name: Install cargo-audit
        uses: taiki-e/install-action@v2
        with:
          tool: cargo-audit
      - name: Run cargo audit
        run: |
          cargo generate-lockfile || true
          cargo audit --deny warnings || true

