Fix audit workflow

[tvpeter]

Description

Fixes #15 and #14

Updates Audit Workflow

Notes to the reviewers

• remove master branch filter
• fix invalid pinned SHA
• removed Swatinem/rust-cache action

Checklists

All Submissions:

• I've signed all my commits
• I followed the contribution guidelines
• I ran cargo fmt and cargo clippy before committing

[ValuedMammal]

I think issue #14 is referring to using actions-rust-lang/setup-rust-toolchain, with cache: true, as we are also using in cont_integration.yml, but don't know if I've missed something.

[oleonardolima]

I think issue #14 is referring to using actions-rust-lang/setup-rust-toolchain, with cache: true, as we are also using in cont_integration.yml, but don't know if I've missed something.

Yes, that's what I meant, instead of using the actions/cache and dtolnay/rust, we can just use the cache feature in the actions-rust-lang/setup-rust-toolchain.

[ValuedMammal]

I think actions/checkout can be bumped to v6 now.

According to zizmor

Official GitHub actions namespaces can be pinned by branch or tag. In other words, actions/checkout@v4 is acceptable.

[ValuedMammal]

@tvpeter For simplicity do you want to stick with using actions/checkout@v6 instead of the full commit hash for "official github actions", i.e. the ones starting with actions/*.

[tvpeter]

I prefer using actions/checkout@v6 because it allows for automatic minor updates instead of a specific full commit hash. However, Luiz suggested we use specific hashes for highest security, which is what Zizmor has been monitoring.

[ValuedMammal]

ACK fc8ba0e

In terms of workflows we should probably also look into resolving credential persistence and overly broad permissions.