ci: add cargo audit job and task

.github/workflows/ci.yml

@@ -27,6 +27,15 @@ jobs:
           components: rustfmt
       - run: cargo +nightly fmt --all -- --check
 
+  audit:
+    name: cargo audit
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v7
+      - uses: taiki-e/install-action@cargo-audit
+      - run: cargo audit
+
   clippy:
     name: clippy (${{ matrix.os }})
     runs-on: ${{ matrix.os }}

devkit.toml

@@ -29,6 +29,11 @@ programs = ["git"]
 args = ["worktree", "remove"]
 reason = "Use devkit's issue binary to remove worktrees: issue end [branch-name]"
 
+[tasks.audit]
+description = "Check Cargo.lock against the RustSec advisory database"
+run = ["cargo", "audit"]
+guard = true
+
 [tasks.build]
 description = "Build the workspace"
 run = ["cargo", "build", "--workspace", "--locked"]