Audit and update Rust dependencies

.github/dependabot.yml

@@ -10,3 +10,15 @@ updates:
       github-actions:
         patterns:
           - "*"
+
+  - package-ecosystem: "cargo"
+    directory: "/"
+    schedule:
+      interval: monthly
+    cooldown:
+      default-days: 7
+    versioning-strategy: increase-if-necessary
+    groups:
+      cargo:
+        patterns:
+          - "*"

.github/workflows/build.yml

@@ -310,7 +310,6 @@ jobs:
 
   attest:
     name: Attest artifacts
-    if: ${{ inputs.attest }}
     needs:
       [
         libs_linux,
@@ -356,6 +355,7 @@ jobs:
 
       - name: Download build artifacts
         uses: actions/download-artifact@v8
+        if: ${{ inputs.attest }}
         with:
           path: artifacts
           merge-multiple: true
@@ -369,14 +369,17 @@ jobs:
             ${{ needs.libs_xcframework.outputs.artifact_id }}
 
       - name: List downloaded artifacts
+        if: ${{ inputs.attest }}
         run: find artifacts
 
       - name: Attest artifacts
+        if: ${{ inputs.attest }}
         uses: actions/attest@v4
         with:
           subject-path: artifacts/*
 
       - name: Attest SBOM
+        if: ${{ inputs.attest }}
         uses: actions/attest@v4
         with:
           sbom-path: bom.json

.github/workflows/tests.yml

@@ -138,6 +138,7 @@ jobs:
 
   build_stable_rust:
     runs-on: ubuntu-latest
+    if: github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository)
     steps:
       - uses: actions/checkout@v7
         with:
@@ -169,6 +170,7 @@ jobs:
 
   test_with_sanitizers:
     runs-on: ubuntu-latest
+    if: github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository)
     steps:
       - uses: actions/checkout@v7
         with:
@@ -194,3 +196,28 @@ jobs:
       - name: Test with AddressSanitizer
         working-directory: dart
         run: dart tool/run_tests.dart asan
+
+  vulnerability_scan:
+    runs-on: ubuntu-latest
+    name: Scan SBOM for vulnerabilities
+    needs: [build_libs]
+    if: github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository)
+    permissions:
+      security-events: write # To upload SARIF report of found vulnerabilities
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - name: Download SBOM
+        uses: actions/download-artifact@v8
+        with:
+          artifact-ids: ${{ needs.build_libs.outputs.sbom }}
+      - name: View SBOM
+        run: cat bom.json
+      - uses: anchore/scan-action@e1165082ffb1fe366ebaf02d8526e7c4989ea9d2 # v7.4.0
+        id: scan
+        with:
+          sbom: bom.json
+          grype-version: v0.117.0 # The default version from the action doesn't support CycloneDX version 1.7 yet.
+          cache-db: true
+          output-format: table

.github/zizmor.yaml

@@ -4,6 +4,7 @@ rules:
     config:
       policies:
         "actions/*": ref-pin
+        "github/*": ref-pin
         "dart-lang/*": ref-pin
         "rust-lang/*": ref-pin
         "gradle/actions/wrapper-validation": ref-pin