ci: add dependency audits and miri

.github/actions/setup/action.yml

@@ -2,6 +2,18 @@ name: 'Setup CI Environment'
 description: 'Shared setup for Rust, Solana, pnpm, and optional surfpool'
 
 inputs:
+  install-rust:
+    description: 'Install Rust toolchain'
+    required: false
+    default: 'true'
+  rust-toolchain:
+    description: 'Rust toolchain to install'
+    required: false
+    default: '1.92'
+  rust-components:
+    description: 'Rust components to install'
+    required: false
+    default: 'rustfmt, clippy'
   enable-rust-cache:
     description: 'Enable Rust caching (restore/save)'
     required: false
@@ -30,18 +42,31 @@ inputs:
     description: "Solana CLI version to install (e.g., 'v4.0.0')"
     required: false
     default: 'v4.0.0'
+  install-just:
+    description: 'Install just'
+    required: false
+    default: 'true'
+  install-pnpm:
+    description: 'Install pnpm and Node.js'
+    required: false
+    default: 'true'
+  install-pnpm-dependencies:
+    description: 'Install pnpm dependencies'
+    required: false
+    default: 'true'
 
 runs:
   using: 'composite'
   steps:
     - name: Setup Rust
+      if: inputs.install-rust == 'true'
       uses: dtolnay/rust-toolchain@master
       with:
-        toolchain: '1.92'
-        components: rustfmt, clippy
+        toolchain: ${{ inputs.rust-toolchain }}
+        components: ${{ inputs.rust-components }}
 
     - name: Rust cache
-      if: inputs.enable-rust-cache == 'true'
+      if: inputs.install-rust == 'true' && inputs.enable-rust-cache == 'true'
       uses: Swatinem/rust-cache@v2
       with:
         workspaces: '. -> target'
@@ -93,24 +118,29 @@ runs:
       run: echo "$HOME/.local/bin" >> $GITHUB_PATH
 
     - name: Install just
+      if: inputs.install-just == 'true'
       uses: extractions/setup-just@v4
       with:
         just-version: '1.50.0'
 
     - name: Install pnpm
+      if: inputs.install-pnpm == 'true'
       uses: pnpm/action-setup@v4
 
     - name: Setup Node.js
+      if: inputs.install-pnpm == 'true'
       uses: actions/setup-node@v6
       with:
         node-version-file: '.nvmrc'
 
     - name: Get pnpm store directory
+      if: inputs.install-pnpm == 'true'
       id: pnpm-store
       shell: bash
       run: echo "path=$(pnpm store path)" >> $GITHUB_OUTPUT
 
     - name: Cache pnpm store
+      if: inputs.install-pnpm == 'true'
       id: pnpm-cache
       uses: actions/cache@v4
       with:
@@ -120,6 +150,7 @@ runs:
           ${{ runner.os }}-pnpm-
 
     - name: Install pnpm dependencies
+      if: inputs.install-pnpm == 'true' && inputs.install-pnpm-dependencies == 'true'
       shell: bash
       run: pnpm install --frozen-lockfile
 

.github/dependabot.yml

@@ -3,7 +3,7 @@ updates:
   - package-ecosystem: cargo
     directory: '/'
     schedule:
-      interval: daily
+      interval: weekly
     open-pull-requests-limit: 10
     cooldown:
       default-days: 7
@@ -20,7 +20,7 @@ updates:
   - package-ecosystem: npm
     directory: '/'
     schedule:
-      interval: daily
+      interval: weekly
     open-pull-requests-limit: 10
     cooldown:
       default-days: 7

.github/workflows/security.yml

@@ -0,0 +1,64 @@
+name: Security
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  schedule:
+    - cron: '0 9 * * *'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  cargo-audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: ./.github/actions/setup
+        with:
+          install-solana: 'false'
+          install-just: 'false'
+          install-pnpm: 'false'
+          rust-cache-key: 'cargo-audit'
+      - uses: taiki-e/install-action@v2
+        with:
+          tool: cargo-audit
+      - run: cargo audit
+
+  pnpm-audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: ./.github/actions/setup
+        with:
+          install-rust: 'false'
+          enable-rust-cache: 'false'
+          install-solana: 'false'
+          install-just: 'false'
+          install-pnpm-dependencies: 'false'
+      - run: pnpm audit --ignore-unfixable
+
+  miri:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: ./.github/actions/setup
+        with:
+          rust-toolchain: 'nightly'
+          rust-components: 'miri'
+          install-solana: 'false'
+          install-just: 'false'
+          install-pnpm: 'false'
+          rust-cache-key: 'miri'
+      - uses: actions/cache@v5
+        with:
+          path: |
+            ~/.cache/org.rust-lang.miri
+          key: miri-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }}
+      - run: cargo +nightly miri setup
+      - run: cargo +nightly miri test -p subscriptions-program

package.json

@@ -43,7 +43,8 @@
       "flatted": "3.4.2",
       "minimatch": "9.0.9",
       "picomatch": "4.0.4",
-      "rollup": "4.60.2"
+      "rollup": "4.60.2",
+      "ws@^8.0.0": "8.20.1"
     }
   }
 }