From a293891dc9d6716515ca7b19d6998b848d4cc4f8 Mon Sep 17 00:00:00 2001
From: furedea <132188853+furedea@users.noreply.github.com>
Date: Mon, 18 May 2026 16:45:11 +0900
Subject: [PATCH] ci: add cargo machete audit

---
 .github/workflows/ci.yml | 22 ++++++++++++++++++----
 flake.nix                |  1 +
 2 files changed, 19 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1bb893f..0333336 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -54,7 +54,7 @@ jobs:
           persist-credentials: false
 
       - name: Install Rust toolchain
-        uses: actions-rust-lang/setup-rust-toolchain@2b1f5e9b395427c92ee4e3331786ca3c37afe2d7 # v1
+        uses: actions-rust-lang/setup-rust-toolchain@2b1f5e9b395427c92ee4e3331786ca3c37afe2d7 # v1.16.0
         with:
           toolchain: stable
           components: clippy
@@ -75,7 +75,7 @@ jobs:
           persist-credentials: false
 
       - name: Install Rust toolchain
-        uses: actions-rust-lang/setup-rust-toolchain@2b1f5e9b395427c92ee4e3331786ca3c37afe2d7 # v1
+        uses: actions-rust-lang/setup-rust-toolchain@2b1f5e9b395427c92ee4e3331786ca3c37afe2d7 # v1.16.0
         with:
           toolchain: stable
           components: rustfmt
@@ -96,7 +96,7 @@ jobs:
           persist-credentials: false
 
       - name: Install Rust toolchain
-        uses: actions-rust-lang/setup-rust-toolchain@2b1f5e9b395427c92ee4e3331786ca3c37afe2d7 # v1
+        uses: actions-rust-lang/setup-rust-toolchain@2b1f5e9b395427c92ee4e3331786ca3c37afe2d7 # v1.16.0
         with:
           toolchain: stable
           rustflags: ""
@@ -104,9 +104,23 @@ jobs:
       - name: Run tests
         run: cargo test
 
+  audit:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Run cargo-machete
+        uses: bnjbvr/cargo-machete@ac30a525c0a8d163a92d727b3ff079ee3f6ecb08 # v0.9.2
+
   all-green:
     if: always()
-    needs: [nix-lint, lint, format, test]
+    needs: [nix-lint, lint, format, test, audit]
     runs-on: ubuntu-latest
     timeout-minutes: 1
     permissions: {}
diff --git a/flake.nix b/flake.nix
index e1fd610..4695ec2 100644
--- a/flake.nix
+++ b/flake.nix
@@ -15,6 +15,7 @@
       devShells.${system}.default = pkgs.mkShell {
         packages = with pkgs; [
           cargo
+          cargo-machete
           clippy
           commitlint
           deadnix