From 9544570b16a39a2aaf12e81a9af9017539a68349 Mon Sep 17 00:00:00 2001
From: Adrian Cole <64215+codefromthecrypt@users.noreply.github.com>
Date: Mon, 9 Feb 2026 23:28:57 +0800
Subject: [PATCH] fix(ci): switch from cargo-audit to cargo-deny for advisory
 scanning (#7032)

Signed-off-by: Adrian Cole <adrian@tetrate.io>
---
 .github/workflows/cargo-audit.yml | 32 -------------------------------
 .github/workflows/cargo-deny.yml  | 28 +++++++++++++++++++++++++++
 deny.toml                         |  6 ++++++
 3 files changed, 34 insertions(+), 32 deletions(-)
 delete mode 100644 .github/workflows/cargo-audit.yml
 create mode 100644 .github/workflows/cargo-deny.yml
 create mode 100644 deny.toml

diff --git a/.github/workflows/cargo-audit.yml b/.github/workflows/cargo-audit.yml
deleted file mode 100644
index 22e15f0f4c..0000000000
--- a/.github/workflows/cargo-audit.yml
+++ /dev/null
@@ -1,32 +0,0 @@
-name: "Cargo Audit"
-on:
-  push:
-    paths:
-      # Run if workflow changes
-      - '.github/workflows/cargo-audit.yml'
-      # Run on changed dependencies
-      - '**/Cargo.toml'
-      - '**/Cargo.lock'
-      # Run if the configuration file changes
-      - '**/audit.toml'
-  # Rerun periodically to pick up new advisories
-  schedule:
-    - cron: '0 0 * * *'
-  # Run manually
-  workflow_dispatch:
-
-jobs:
-  audit:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      issues: write
-    steps:
-      - uses: actions/checkout@v4
-        # https://github.com/marketplace/actions/cargo-audit-your-rust-dependencies
-      - uses: actions-rust-lang/audit@72c09e02f132669d52284a3323acdb503cfc1a24
-        name: Audit Rust Dependencies
-        with:
-          # sqlx-mysql pulls in rsa, but goose only uses sqlite. cargo-audit
-          # can't distinguish used from unused deps (rustsec/rustsec#1119).
-          ignore: RUSTSEC-2023-0071
diff --git a/.github/workflows/cargo-deny.yml b/.github/workflows/cargo-deny.yml
new file mode 100644
index 0000000000..5dfa1c924f
--- /dev/null
+++ b/.github/workflows/cargo-deny.yml
@@ -0,0 +1,28 @@
+name: "Cargo Deny"
+on:
+  push:
+    paths:
+      # Run if workflow changes
+      - '.github/workflows/cargo-deny.yml'
+      # Run on changed dependencies
+      - '**/Cargo.toml'
+      - '**/Cargo.lock'
+      # Run if the configuration file changes
+      - 'deny.toml'
+  # Rerun periodically to pick up new advisories
+  schedule:
+    - cron: '0 0 * * *'
+  # Run manually
+  workflow_dispatch:
+
+jobs:
+  deny:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v4
+      # https://github.com/EmbarkStudios/cargo-deny-action v2.0.15
+      - uses: EmbarkStudios/cargo-deny-action@3fd3802e88374d3fe9159b834c7714ec57d6c979
+        with:
+          command: check advisories
diff --git a/deny.toml b/deny.toml
new file mode 100644
index 0000000000..bd3d86ca23
--- /dev/null
+++ b/deny.toml
@@ -0,0 +1,6 @@
+[advisories]
+# Deny yanked crates to catch supply chain issues early.
+yanked = "deny"
+# Emulate cargo-audit which only checks vulnerabilities and yanked crates, not unmaintained/unsound.
+unmaintained = "none"
+unsound = "none"