ci: add package audit checks

.github/workflows/ci.yml

@@ -42,6 +42,21 @@ jobs:
       - run: cargo test --package dynamic-fee-sharing
         shell: bash
 
+  clippy:
+    runs-on: ubuntu-latest
+    needs: program_changed_files
+    if: needs.program_changed_files.outputs.program == 'true'
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master (2026-10-16)
+        with:
+          toolchain: ${{ env.TOOLCHAIN }}
+          components: clippy
+      # Cache rust, cargo
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+      - run: cargo clippy --locked --all-targets -- -D warnings
+        shell: bash
+
   program_test:
     runs-on: ubuntu-latest
     needs: program_changed_files

.github/workflows/dependency-audit.yml

@@ -0,0 +1,44 @@
+name: Dependency audit
+
+# Runs on every PR, whatever the base branch or the files changed: new advisories are published
+# against dependencies that are already in the lockfile
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  # advisories, licenses, bans and sources, see deny.toml
+  cargo_deny:
+    name: Cargo Deny
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+
+      - name: Check advisories, licenses, bans and sources
+        uses: EmbarkStudios/cargo-deny-action@3c6349835b2b7b196a839186cb8b78e02f7b5f25 # v2.1.1
+        with:
+          command: check
+
+  # advisories of every dependency in bun.lock, dev ones included, ignored ones are in osv-scanner.toml
+  osv_scanner:
+    name: OSV Scanner
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+
+      - name: Scan bun.lock
+        uses: google/osv-scanner-action/osv-scanner-action@b1d267aea5211fa648d9d442fa64b90dbdcbdd36 # v2.7.0
+        with:
+          scan-args: |-
+            scan
+            source
+            -L
+            bun.lock

bunfig.toml

@@ -0,0 +1,4 @@
+[install]
+# only resolve versions published at least a week ago (in seconds), a compromised release is
+# usually caught and unpublished within days
+minimumReleaseAge = 604800