Run audits only when their inputs change and Dependabot monthly

.github/dependabot.yml

@@ -4,29 +4,10 @@ updates:
   - package-ecosystem: github-actions
     directory: /
     schedule:
-      interval: weekly
+      interval: monthly
     cooldown:
       default-days: 7
-    # CodeQL refuses to run when its init and analyze steps differ, so they move in one pull request.
     groups:
-      codeql-action:
+      github-actions:
         patterns:
-          - github/codeql-action*
-  - package-ecosystem: cargo
-    directory: /smoke
-    schedule:
-      interval: weekly
-    cooldown:
-      default-days: 7
-  - package-ecosystem: cargo
-    directory: /wasm
-    schedule:
-      interval: weekly
-    cooldown:
-      default-days: 7
-  - package-ecosystem: cargo
-    directory: /fuzz
-    schedule:
-      interval: weekly
-    cooldown:
-      default-days: 7
+          - "*"

.github/workflows/audit.yml

@@ -0,0 +1,45 @@
+---
+name: Audit
+
+"on":
+  pull_request:
+    paths:
+      - Cargo.lock
+      - "**/Cargo.toml"
+      - deny.toml
+      - .cargo/audit.toml
+      - .github/workflows/audit.yml
+  push:
+    branches: [main]
+    paths:
+      - Cargo.lock
+      - "**/Cargo.toml"
+      - deny.toml
+      - .cargo/audit.toml
+      - .github/workflows/audit.yml
+  schedule:
+    - cron: "0 4 * * 1"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref == 'refs/heads/main' && github.run_id || github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
+jobs:
+  deny:
+    name: Dependencies of the test crates pass cargo-deny
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - run: |
+          rustup toolchain install stable --profile minimal
+          rustup default stable
+      - uses: taiki-e/install-action@1e29709c0ec63babbe8f266397a465f29a825f91 # v2.87.31
+        with:
+          tool: cargo-deny@0.20.2
+      - run: cargo deny --manifest-path smoke/Cargo.toml check
+      - run: cargo deny --manifest-path wasm/Cargo.toml check

.github/workflows/ci.yml

@@ -95,22 +95,6 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
 
-  deny:
-    name: Dependencies of the test crates pass cargo-deny
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-      - run: |
-          rustup toolchain install stable --profile minimal
-          rustup default stable
-      - uses: taiki-e/install-action@1e29709c0ec63babbe8f266397a465f29a825f91 # v2.87.31
-        with:
-          tool: cargo-deny@0.20.2
-      - run: cargo deny --manifest-path smoke/Cargo.toml check
-      - run: cargo deny --manifest-path wasm/Cargo.toml check
-
   compile:
     name: Compile the packaged amalgamation on ${{ matrix.os }}
     runs-on: ${{ matrix.os }}