security.yml

name: Security Audit

on:
  schedule:
    # Daily at 02:00 UTC to catch newly disclosed advisories in pinned deps.
    - cron: "0 2 * * *"
  push:
    branches: [main]
    paths:
      - "mix.exs"
      - "mix.lock"
      - "native/whisper_cpp_native/Cargo.toml"
      - "native/whisper_cpp_native/Cargo.lock"
  workflow_dispatch:

permissions: {}

concurrency:
  group: security-${{ github.ref }}
  cancel-in-progress: true

jobs:
  audit:
    name: Dependency Audit
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read # checkout source
      issues: write # open an issue when the audit fails
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124 # v1.24.1
        env:
          INSTALL_DIR_FOR_OTP: ${{ runner.tool_cache }}/setup-beam/otp-29.1.1
          INSTALL_DIR_FOR_ELIXIR: ${{ runner.tool_cache }}/setup-beam/elixir-1.20.4
        with:
          elixir-version: "1.20.4"
          otp-version: "29.1.1"

      - name: Install dependencies
        run: |
          mix local.hex --force
          mix local.rebar --force
          mix deps.get

      - name: Audit Hex dependencies
        run: MIX_ENV=test mix hex.audit

      - name: Install cargo-audit
        if: ${{ !cancelled() }}
        uses: taiki-e/install-action@dfae9bf3d6f6c6f20ef4ebb3486c01a51341ff12 # v2.87.18
        with:
          tool: cargo-audit

      - name: Audit Rust dependencies
        # Runs even when the Hex audit failed so one run reports both
        # ecosystems. The NIF crate carries the native surface; RustSec
        # advisories against its Rust dependency tree must fail this workflow
        # too.
        if: ${{ !cancelled() }}
        working-directory: native/whisper_cpp_native
        run: cargo audit

      - name: Report audit failure
        if: failure()
        uses: $/.github/actions/report-failure
        with:
          result: failure
          title: Security Audit Failed
          subject: security audit
          labels: >-
            [{"name": "security", "color": "d73a4a", "description": "Security-relevant"},
            {"name": "automated", "color": "ededed", "description": "Created by automation"}]

      - name: Resolve audit issue on success
        if: success()
        uses: $/.github/actions/report-failure
        with:
          result: success
          title: Security Audit Failed
          subject: security audit