From 991c04adb6f8c132cbb0dd69a1a79b99e36b389a Mon Sep 17 00:00:00 2001
From: Clement Tsang <34804052+ClementTsang@users.noreply.github.com>
Date: Thu, 6 Aug 2026 04:21:57 -0400
Subject: [PATCH] ci: add back audit CI check (#2186)

Adds back the audit workflow using [`audit-check`](https://github.com/rustsec/audit-check). This also adds a drive-by update for `anyhow` to `1.0.104` since it was hitting an unsound warning.
---
 .github/workflows/audit.yml   | 44 +++++++++++++++++++++++++++++++++++
 Cargo.lock                    |  4 ++--
 Cargo.toml                    |  2 +-
 scripts/schema_gen/Cargo.lock |  4 ++--
 scripts/schema_gen/Cargo.toml |  2 +-
 5 files changed, 50 insertions(+), 6 deletions(-)
 create mode 100644 .github/workflows/audit.yml

diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml
new file mode 100644
index 00000000..631b6c36
--- /dev/null
+++ b/.github/workflows/audit.yml
@@ -0,0 +1,44 @@
+name: Audit Rust dependencies
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+permissions: {}
+
+jobs:
+  pre-job:
+    runs-on: ubuntu-latest
+    outputs:
+      should_skip: ${{ steps.skip_check.outputs.should_skip }}
+    steps:
+      - name: Check if this action should be skipped
+        id: skip_check
+        uses: ClementTsang/skip-duplicate-actions@41b0a75f656d455934ffa6a46b779d8d996ac47c
+        with:
+          skip_after_successful_duplicate: "true"
+          paths: '[".github/workflows/audit.yml", "**/Cargo.lock", "**/Cargo.toml"]'
+          do_not_skip: '["workflow_dispatch", "push"]'
+
+  rust_deps_audit:
+    needs: pre-job
+    runs-on: ubuntu-latest
+    # Required to create check results if an action is required.
+    permissions: { checks: write }
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Enable Rust cache
+        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # 2.9.1
+        if: ${{ github.event_name != 'pull_request' || ! github.event.pull_request.head.repo.fork }} # If it is a PR, only if not a fork
+        with:
+          key: ${{ matrix.info.target }}
+          cache-all-crates: false
+          cache-bin: true
+
+      - name: Run audit check
+        uses: rustsec/audit-check@858dc40f52ca2b8570b7a997c1c4e35c6fc9a432
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/Cargo.lock b/Cargo.lock
index 8ec05cde..b9af8d56 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -69,9 +69,9 @@ dependencies = [
 
 [[package]]
 name = "anyhow"
-version = "1.0.101"
+version = "1.0.104"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5f0e0fee31ef5ed1ba1316088939cea399010ed7731dba877ed44aeb407a75ea"
+checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470"
 
 [[package]]
 name = "approx"
diff --git a/Cargo.toml b/Cargo.toml
index 43901776..e1e8c9e8 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -66,7 +66,7 @@ logging = ["fern", "log"]
 generate_schema = ["schemars", "strum"]
 
 [dependencies]
-anyhow = "1.0.101"
+anyhow = "1.0.104"
 clap = { version = "4.6.4", features = ["default", "cargo", "wrap_help", "derive"] }
 concat-string = "1.0.1"
 crossterm = "0.29.0"
diff --git a/scripts/schema_gen/Cargo.lock b/scripts/schema_gen/Cargo.lock
index 5baa7dc8..b84118af 100644
--- a/scripts/schema_gen/Cargo.lock
+++ b/scripts/schema_gen/Cargo.lock
@@ -69,9 +69,9 @@ dependencies = [
 
 [[package]]
 name = "anyhow"
-version = "1.0.103"
+version = "1.0.104"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2a4385e2e34eb35d6b3efe798b9eb88096925d87726c0798709bf56d9ed84af3"
+checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470"
 
 [[package]]
 name = "approx"
diff --git a/scripts/schema_gen/Cargo.toml b/scripts/schema_gen/Cargo.toml
index ca3dc75a..0a165eb1 100644
--- a/scripts/schema_gen/Cargo.toml
+++ b/scripts/schema_gen/Cargo.toml
@@ -5,7 +5,7 @@ edition = "2024"
 publish = false
 
 [dependencies]
-anyhow = "1.0.101"
+anyhow = "1.0.104"
 bottom = { path = "../../", features = ["generate_schema"] }
 clap = { version = "4.6.4", features = ["derive"] }
 itertools = "0.15.0"