From 112f1e21000e9e2b5657b75c0e9fdd7019cfaedf Mon Sep 17 00:00:00 2001
From: Jacob Gadikian <jacobgadikian@gmail.com>
Date: Tue, 22 Apr 2025 22:59:15 +0700
Subject: [PATCH 1/3] add cargo audit and cargo deny

---
 .github/workflows/cargo-audit.yml | 38 +++++++++++++++++++++++++++++++
 .github/workflows/cargo-deny.yml  | 35 ++++++++++++++++++++++++++++
 .github/workflows/lint-go.yml     |  2 +-
 3 files changed, 74 insertions(+), 1 deletion(-)
 create mode 100644 .github/workflows/cargo-audit.yml
 create mode 100644 .github/workflows/cargo-deny.yml

diff --git a/.github/workflows/cargo-audit.yml b/.github/workflows/cargo-audit.yml
new file mode 100644
index 000000000..9b42354f9
--- /dev/null
+++ b/.github/workflows/cargo-audit.yml
@@ -0,0 +1,38 @@
+name: Cargo Audit
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "**/Cargo.toml"
+      - "**/Cargo.lock"
+      - ".github/workflows/cargo-audit.yml"
+  pull_request:
+    paths:
+      - "**/Cargo.toml"
+      - "**/Cargo.lock"
+      - ".github/workflows/cargo-audit.yml"
+  schedule:
+    - cron: "0 0 * * 0" # Run weekly on Sundays at midnight
+
+jobs:
+  cargo-audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Install cargo-audit
+        run: cargo install cargo-audit
+
+      - name: Run cargo audit
+        working-directory: ./libwasmvm
+        run: cargo audit
+        continue-on-error: ${{ github.event_name == 'schedule' }} # Don't fail scheduled runs
+
+      - name: Run cargo audit with ignore unmaintained
+        working-directory: ./libwasmvm
+        run: cargo audit --ignore RUSTSEC-2024-0436 --ignore RUSTSEC-2024-0370
+        # These are the unmaintained crates we're already tracking in deny.toml
diff --git a/.github/workflows/cargo-deny.yml b/.github/workflows/cargo-deny.yml
new file mode 100644
index 000000000..14ef7e15e
--- /dev/null
+++ b/.github/workflows/cargo-deny.yml
@@ -0,0 +1,35 @@
+name: Cargo Deny
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "**/Cargo.toml"
+      - "**/Cargo.lock"
+      - "**/deny.toml"
+      - ".github/workflows/cargo-deny.yml"
+  pull_request:
+    paths:
+      - "**/Cargo.toml"
+      - "**/Cargo.lock"
+      - "**/deny.toml"
+      - ".github/workflows/cargo-deny.yml"
+
+jobs:
+  cargo-deny:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        checks:
+          - advisories
+          - bans
+          - licenses
+          - sources
+    steps:
+      - uses: actions/checkout@v3
+      - uses: EmbarkStudios/cargo-deny-action@v1
+        with:
+          command: check ${{ matrix.checks }}
+          arguments: --all-features --exclude-dev
+          rust-version: stable
+          manifest-path: libwasmvm/Cargo.toml
diff --git a/.github/workflows/lint-go.yml b/.github/workflows/lint-go.yml
index 9cdf66336..626d44b23 100644
--- a/.github/workflows/lint-go.yml
+++ b/.github/workflows/lint-go.yml
@@ -20,7 +20,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
         with:
-          go-version: "1.23.4"
+          go-version: "1.24"
           cache: false
       - name: golangci-lint
         uses: golangci/golangci-lint-action@v7

From a2ba26058697ccd0452bc641a00189dd9806d10f Mon Sep 17 00:00:00 2001
From: Jacob Gadikian <jacobgadikian@gmail.com>
Date: Tue, 22 Apr 2025 23:46:36 +0700
Subject: [PATCH 2/3] Update cargo-deny.yml

---
 .github/workflows/cargo-deny.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.github/workflows/cargo-deny.yml b/.github/workflows/cargo-deny.yml
index 14ef7e15e..93b229ef3 100644
--- a/.github/workflows/cargo-deny.yml
+++ b/.github/workflows/cargo-deny.yml
@@ -23,7 +23,6 @@ jobs:
         checks:
           - advisories
           - bans
-          - licenses
           - sources
     steps:
       - uses: actions/checkout@v3

From 4d5922459f5b04bcfb30929acc931f3f588d55a7 Mon Sep 17 00:00:00 2001
From: Jacob Gadikian <jacobgadikian@gmail.com>
Date: Tue, 22 Apr 2025 23:51:11 +0700
Subject: [PATCH 3/3] Update cargo-deny.yml

---
 .github/workflows/cargo-deny.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/cargo-deny.yml b/.github/workflows/cargo-deny.yml
index 93b229ef3..a43f8f37f 100644
--- a/.github/workflows/cargo-deny.yml
+++ b/.github/workflows/cargo-deny.yml
@@ -21,7 +21,7 @@ jobs:
     strategy:
       matrix:
         checks:
-          - advisories
+      #    - advisories  - this should be restored at some point
           - bans
           - sources
     steps: