Dependency Audit #2

	name: Dependency Audit

	on:
	schedule:
	- cron: "0 8 * * 1" # Every Monday at 08:00 UTC
	workflow_dispatch:

	jobs:
	audit:
	name: Audit dependencies
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4

	- uses: dtolnay/rust-toolchain@stable
	with:
	toolchain: 1.77.2

	- uses: oven-sh/setup-bun@v2

	- name: Install cargo-audit
	run: cargo install cargo-audit --locked

	- name: Rust audit
	id: rust_audit
	run: cargo audit --manifest-path kernel/Cargo.toml --json > rust-audit.json
	continue-on-error: true

	- name: Bun audit
	id: bun_audit
	run: bun audit --json > bun-audit.json
	continue-on-error: true

	- name: Open issue on critical findings
	if: steps.rust_audit.outcome == 'failure' \|\| steps.bun_audit.outcome == 'failure'
	uses: actions/github-script@v7
	with:
	script: \|
	const date = new Date().toISOString().split('T')[0];
	await github.rest.issues.create({
	owner: context.repo.owner,
	repo: context.repo.repo,
	title: `[Security] Dependency vulnerabilities found — ${date}`,
	body: [
	'## Automated Dependency Audit',
	'',
	'The weekly `cargo audit` / `bun audit` run found vulnerabilities.',
	'',
	'Action required: review the [workflow run](' +
	`${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}` +
	') and update affected dependencies.',
	'',
	'> This issue was opened automatically by the `deps-audit` workflow.',
	].join('\n'),
	labels: ['security', 'dependencies'],
	});

Provide feedback