From abb31de93c3aec59ee41d1f6adf95358882bb399 Mon Sep 17 00:00:00 2001
From: Yuval Kogman <nothingmuch@woobling.org>
Date: Fri, 22 May 2026 03:09:33 +0000
Subject: [PATCH] ci: scan dependencies daily

---
 .github/workflows/vulnerability-scan.yml | 43 ++++++++++++++++++++++++
 flake.lock                               | 17 ++++++++++
 flake.nix                                |  4 +++
 nix/checks.nix                           | 14 ++++++++
 nix/devshell.nix                         |  2 ++
 5 files changed, 80 insertions(+)
 create mode 100644 .github/workflows/vulnerability-scan.yml

diff --git a/.github/workflows/vulnerability-scan.yml b/.github/workflows/vulnerability-scan.yml
new file mode 100644
index 00000000..520e0b9f
--- /dev/null
+++ b/.github/workflows/vulnerability-scan.yml
@@ -0,0 +1,43 @@
+name: Vulnerability scan
+on:
+  schedule:
+    - cron: "0 0 * * *"
+  workflow_dispatch:
+permissions:
+  contents: read
+  id-token: write
+concurrency:
+  group: vulnerability-scan
+  cancel-in-progress: false
+jobs:
+  scan:
+    name: Scan dependencies
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v6
+      - uses: DeterminateSystems/nix-installer-action@main
+      - uses: DeterminateSystems/magic-nix-cache-action@main
+      - name: Update vulnerability databases
+        run: nix flake update
+      - name: Audit Cargo dependencies
+        run: nix build '.#checks.x86_64-linux.cargo-audit'
+      - name: Build development shell closure
+        run: nix build --out-link result-vulnerability-scan-devshell '.#devShells.x86_64-linux.default'
+      - name: Build package closures
+        run: |
+          nix build --out-link result-vulnerability-scan-default '.#packages.x86_64-linux.default'
+          nix build --out-link result-vulnerability-scan-validate-commits '.#packages.x86_64-linux.validate-commits'
+      - name: Cache NVD database
+        uses: actions/cache@v4
+        with:
+          path: ~/.cache/vulnix
+          key: vulnix-nvd-${{ github.run_id }}
+          restore-keys: |
+            vulnix-nvd-
+      - name: Scan Nix closure
+        run: |
+          nix develop -c vulnix --closure \
+            "$(readlink -f result-vulnerability-scan-devshell)" \
+            "$(readlink -f result-vulnerability-scan-default)" \
+            "$(readlink -f result-vulnerability-scan-validate-commits)"
diff --git a/flake.lock b/flake.lock
index 6eed11c8..3b7ca3c6 100644
--- a/flake.lock
+++ b/flake.lock
@@ -68,6 +68,7 @@
         "flake-parts": "flake-parts",
         "nixpkgs": "nixpkgs",
         "rust-overlay": "rust-overlay",
+        "rustsec-advisory-db": "rustsec-advisory-db",
         "treefmt-nix": "treefmt-nix"
       }
     },
@@ -91,6 +92,22 @@
         "type": "github"
       }
     },
+    "rustsec-advisory-db": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1784741571,
+        "narHash": "sha256-ZAK7+XkYOnLGpa7boc5RGtIpWrS7nt6glXCKjcIpV7U=",
+        "owner": "RustSec",
+        "repo": "advisory-db",
+        "rev": "b54e9b51596ad6a02ca5355c1f2743cc5b5d502f",
+        "type": "github"
+      },
+      "original": {
+        "owner": "RustSec",
+        "repo": "advisory-db",
+        "type": "github"
+      }
+    },
     "treefmt-nix": {
       "inputs": {
         "nixpkgs": [
diff --git a/flake.nix b/flake.nix
index 5cd4a315..d8e5d1ce 100644
--- a/flake.nix
+++ b/flake.nix
@@ -7,6 +7,10 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
     crane.url = "github:ipetkov/crane";
+    rustsec-advisory-db = {
+      url = "github:RustSec/advisory-db";
+      flake = false;
+    };
     treefmt-nix = {
       url = "github:numtide/treefmt-nix";
       inputs.nixpkgs.follows = "nixpkgs";
diff --git a/nix/checks.nix b/nix/checks.nix
index 18d226fd..e73d2980 100644
--- a/nix/checks.nix
+++ b/nix/checks.nix
@@ -100,6 +100,20 @@
       checks = testChecks // {
         build = toolchains.nightly.buildPackage (checkArgs // { cargoArtifacts = cargoArtifactsRelease; });
 
+        cargo-audit =
+          pkgs.runCommand "cargo-audit-${rev}"
+            {
+              inherit src;
+              nativeBuildInputs = [ pkgs.cargo-audit ];
+            }
+            ''
+              cargo-audit audit \
+                --no-fetch \
+                --db ${inputs.rustsec-advisory-db} \
+                --file "$src/Cargo.lock"
+              mkdir -p $out
+            '';
+
         mutants = toolchains.nightly.mkCargoDerivation (
           checkArgs
           // {
diff --git a/nix/devshell.nix b/nix/devshell.nix
index 883a7cb9..bd512128 100644
--- a/nix/devshell.nix
+++ b/nix/devshell.nix
@@ -11,6 +11,7 @@
         craneLib:
         craneLib.devShell {
           packages = with pkgs; [
+            cargo-audit
             cargo-llvm-cov
             cargo-nextest
             cargo-sort
@@ -18,6 +19,7 @@
             config.treefmt.build.wrapper
             just
             rust-analyzer
+            vulnix
           ];
         };
     in