Laszlo NagyandClaude Opus 5.5 68fd15c4ce ci: check advisories on a schedule and lock CI builds ...

A new RustSec advisory can turn a dependency bad with no commit in this
repo, and the audit job only ran on push. The advisory check moves next
to CodeQL, which already runs weekly. The license, ban, and source
checks only change with Cargo.toml or Cargo.lock, so they stay with the
build.

Every cargo call in CI now passes --locked, so CI tests the committed
lockfile instead of one it resolved itself.

Push builds are limited to master and next. A PR branch pushed to this
repo used to run every workflow twice.

The cargo-deny version pin is documented in .deny.toml, where the
syntax it protects lives, and both workflows point there.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-25 09:07:00 +00:00

..

build_rust.yml

ci: check advisories on a schedule and lock CI builds

2026-10-25 09:07:00 +00:00

codeql.yml

ci: check advisories on a schedule and lock CI builds

2026-10-25 09:07:00 +00:00

pages.yml

ci: check advisories on a schedule and lock CI builds

2026-10-25 09:07:00 +00:00