CI: Add cargo-audit workflow

[tnull]

Run security audits against all three checked-in lock files using the official rustsec/audit-check action. Triggers on push, PRs, and daily via cron to catch newly published advisories.

Co-Authored-By: HAL 9000

[tnull]

Also bumped some dependencies, rest should be done in #556 or #536.

[luisschwab]

ACK 2e56f00

[luisschwab]

cc @satsfy

[satsfy]

Why is Cargo.lock part of the matrix?

[tcharding]

against all three checked-in lock files

Yeah there should only be two. Did I commit one in electrsd accidentally or something?

[tcharding]

As it stands no-one is ever going to look at the auction run (well I definitely won't remember to do it). Can we have the action raise an issue if there are warnings? Or is that going to be too noisy? I don't have a lot of experience with cargo audit. (We do this already in rust-bitcoin for mutation testing when zombies survive.)

[luisschwab]

The GitHub bot will usually open an issue when there is a new RUSTSEC (see bitcoindevkit/bdk#2178).

[tcharding]

Does that bot hit projects to use cargo audit?

[luisschwab]

Actually, I think we need to use the actions-rust-lang/audit action for it to open issues. On my personal repos I only use the bare cargo audit and it does not open any issues there.

This is bdk's audit job:

name: Audit

on:
  push:
    paths:
      # Run if workflow changes
      - '.github/workflows/audit.yml'
      # Run on changed dependencies
      - '**/Cargo.toml'
      - '**/Cargo.lock'
      # Run if the configuration file changes
      - '**/audit.toml'
  # Rerun periodically to pick up new advisories
  schedule:
    - cron: '0 0 * * *' # Nightly
  # Run manually
  workflow_dispatch:

jobs:
  audit:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      issues: write
    steps:
      - uses: actions/checkout@v6
        with:
          persist-credentials: false
      - uses: actions-rust-lang/audit@v1
        name: Audit Rust Dependencies

I could be talking out of my ass, I'm not certain about this.

[tcharding]

Sounds legit :)