name: Weekly OSV dependency audit

on:
  schedule:
    # Runs every Monday. Change the minute to stagger repositories.
    - cron: "41 3 * * 1"
  workflow_dispatch:

jobs:
  dependency-audit:
    runs-on: linux-arm64
    timeout-minutes: 20

    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Install cargo-audit
        uses: taiki-e/install-action@v2
        with:
          tool: cargo-audit@0.22.2

      - name: Audit Rust dependencies
        run: |
          cargo audit
          cargo audit --file tools/macos-packager/Cargo.lock

      - name: Scan dependencies for known vulnerabilities
        uses: docker://ghcr.io/google/osv-scanner:v2
        with:
          args: scan source --recursive .