ci: run the security audit, benchmark on demand, keep release secrets out of scripts

.github/workflows/benchmark.yml

@@ -1,23 +1,21 @@
 name: Benchmarking
 
-on: [pull_request, push]
+# On demand only. Nothing compares or stores the results, and merge.yml's
+# `clippy --all-targets` already compiles the benches on every PR.
+on:
+  workflow_dispatch:
 
 env:
   RUST_BACKTRACE: 1
   RUSTFLAGS: "-D warnings"
 
-
 jobs:
   bench:
     name: Benchmarking
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
-      - uses: actions-rs/toolchain@v1
-        with:
-          profile: minimal
-          toolchain: stable
-          override: true
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
 
       - name: Generate Cargo.lock
         run: cargo generate-lockfile
@@ -32,9 +30,5 @@ jobs:
             target/
           key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
 
-      - name: Cargo build
-        if: steps.${{ runner.os }}-cargo-build-target-${{ hashFiles('**/Cargo.lock') }}.outputs.cache-hit != 'true'
-        run: cargo build --release
-
       - name: Cargo bench
         run: cargo bench

.github/workflows/merge.yml

@@ -14,13 +14,9 @@ jobs:
       matrix:
         os: [ubuntu-latest, windows-latest, macOS-latest]
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4
       - name: Install Rust
-        uses: actions-rs/toolchain@v1
-        with:
-          profile: minimal
-          toolchain: stable
-          override: true
+        uses: dtolnay/rust-toolchain@stable
 
       - uses: actions/cache@v4
         with:
@@ -39,12 +35,9 @@ jobs:
     name: Enforce Clippy constraints
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
-      - uses: actions-rs/toolchain@v1
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
         with:
-          profile: minimal
-          toolchain: stable
-          override: true
           components: clippy
 
       - uses: actions/cache@v4
@@ -64,11 +57,8 @@ jobs:
     name: Unused dependency check
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
-      - uses: actions-rs/toolchain@v1
-        with:
-          toolchain: nightly
-          override: true
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@nightly
 
       - name: Run cargo-udeps
         uses: aig787/cargo-udeps-action@v1
@@ -79,19 +69,15 @@ jobs:
   cargo-deny:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4
       - uses: EmbarkStudios/cargo-deny-action@v2
 
   tests:
     name: Test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
-      - uses: actions-rs/toolchain@v1
-        with:
-          profile: minimal
-          toolchain: stable
-          override: true
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
 
       - uses: actions/cache@v4
         with:
@@ -110,12 +96,8 @@ jobs:
     name: Test 32bit
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
-      - uses: actions-rs/toolchain@v1
-        with:
-          profile: minimal
-          toolchain: stable
-          override: true
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
       - name: Install 32bit target
         run: rustup target install i686-unknown-linux-gnu
       - name: Install GCC Multilib
@@ -140,12 +122,8 @@ jobs:
     name: Dry run publish
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
-      - uses: actions-rs/toolchain@v1
-        with:
-          profile: minimal
-          toolchain: stable
-          override: true
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
 
       - name: Dry run publish
         run: cargo publish --dry-run

.github/workflows/release.yml

@@ -17,13 +17,9 @@ jobs:
       matrix:
         os: [ubuntu-latest, windows-latest, macOS-latest]
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4
       - name: Install Rust
-        uses: actions-rs/toolchain@v1
-        with:
-          profile: minimal
-          toolchain: stable
-          override: true
+        uses: dtolnay/rust-toolchain@stable
 
       - uses: actions/cache@v4
         with:
@@ -49,12 +45,6 @@ jobs:
           fetch-depth: "0"
           token: ${{ secrets.SELF_ENCRYPTION_PAT }}
       - uses: dtolnay/rust-toolchain@stable
-
-      - uses: actions-rs/toolchain@v1
-        with:
-          profile: minimal
-          toolchain: stable
-          override: true
 
       # This is required to allow `release-plz` to create tags
       - shell: bash
@@ -66,8 +56,11 @@ jobs:
       - shell: bash
         run: cargo binstall --no-confirm release-plz
 
+      # Secrets go through env, not ${{ }} in the script. cargo reads
+      # CARGO_REGISTRY_TOKEN when release-plz publishes, so no `cargo login`.
       - name: publish crates
         shell: bash
-        run: |
-          cargo login "${{ secrets.CRATES_IO_TOKEN }}"
-          release-plz release --git-token ${{ secrets.SELF_ENCRYPTION_PAT }}
+        env:
+          CARGO_REGISTRY_TOKEN: ${{ secrets.CRATES_IO_TOKEN }}
+          GIT_TOKEN: ${{ secrets.SELF_ENCRYPTION_PAT }}
+        run: release-plz release --git-token "$GIT_TOKEN"

.github/workflows/security_audit.yml

@@ -1,13 +1,20 @@
 name: Security audit
+
+# Daily, so new advisories show up between PRs (merge.yml's cargo-deny only
+# runs on pull requests). Same tool and deny.toml as the PR check.
 on:
   schedule:
     - cron: '0 0 * * *'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
 jobs:
   audit:
-    if: github.repository_owner == 'maidsafe'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
-      - uses: actions-rs/audit-check@v1
+      - uses: actions/checkout@v4
+      - uses: EmbarkStudios/cargo-deny-action@v2
         with:
-          token: ${{ secrets.GITHUB_TOKEN }}
+          command: check advisories