ci: add back audit CI check (#2186)

Adds back the audit workflow using [`audit-check`](https://github.com/rustsec/audit-check). This also adds a drive-by update for `anyhow` to `1.0.104` since it was hitting an unsound warning.

.github/workflows/audit.yml

@@ -0,0 +1,44 @@
+name: Audit Rust dependencies
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+permissions: {}
+
+jobs:
+  pre-job:
+    runs-on: ubuntu-latest
+    outputs:
+      should_skip: ${{ steps.skip_check.outputs.should_skip }}
+    steps:
+      - name: Check if this action should be skipped
+        id: skip_check
+        uses: ClementTsang/skip-duplicate-actions@41b0a75f656d455934ffa6a46b779d8d996ac47c
+        with:
+          skip_after_successful_duplicate: "true"
+          paths: '[".github/workflows/audit.yml", "**/Cargo.lock", "**/Cargo.toml"]'
+          do_not_skip: '["workflow_dispatch", "push"]'
+
+  rust_deps_audit:
+    needs: pre-job
+    runs-on: ubuntu-latest
+    # Required to create check results if an action is required.
+    permissions: { checks: write }
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Enable Rust cache
+        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # 2.9.1
+        if: ${{ github.event_name != 'pull_request' || ! github.event.pull_request.head.repo.fork }} # If it is a PR, only if not a fork
+        with:
+          key: ${{ matrix.info.target }}
+          cache-all-crates: false
+          cache-bin: true
+
+      - name: Run audit check
+        uses: rustsec/audit-check@858dc40f52ca2b8570b7a997c1c4e35c6fc9a432
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}

Cargo.lock

@@ -69,9 +69,9 @@ dependencies = [
 
 [[package]]
 name = "anyhow"
-version = "1.0.101"
+version = "1.0.104"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5f0e0fee31ef5ed1ba1316088939cea399010ed7731dba877ed44aeb407a75ea"
+checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470"
 
 [[package]]
 name = "approx"

Cargo.toml

@@ -66,7 +66,7 @@ logging = ["fern", "log"]
 generate_schema = ["schemars", "strum"]
 
 [dependencies]
-anyhow = "1.0.101"
+anyhow = "1.0.104"
 clap = { version = "4.6.4", features = ["default", "cargo", "wrap_help", "derive"] }
 concat-string = "1.0.1"
 crossterm = "0.29.0"

scripts/schema_gen/Cargo.lock

@@ -69,9 +69,9 @@ dependencies = [
 
 [[package]]
 name = "anyhow"
-version = "1.0.103"
+version = "1.0.104"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2a4385e2e34eb35d6b3efe798b9eb88096925d87726c0798709bf56d9ed84af3"
+checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470"
 
 [[package]]
 name = "approx"

scripts/schema_gen/Cargo.toml

@@ -5,7 +5,7 @@ edition = "2024"
 publish = false
 
 [dependencies]
-anyhow = "1.0.101"
+anyhow = "1.0.104"
 bottom = { path = "../../", features = ["generate_schema"] }
 clap = { version = "4.6.4", features = ["derive"] }
 itertools = "0.15.0"