Add cargo-audit security scan to CI

[Miracle656]

Background

The Soroban smart contracts have Cargo dependencies that could contain known CVEs. Adding cargo audit to CI automatically fails the build if a vulnerability is detected in any transitive dependency, keeping the contracts secure without manual tracking.

What to build

Add a CI job that runs cargo audit against the contracts workspace on every PR targeting main.

Key files

• .github/workflows/ci.yml — add a new job here
• contracts/Cargo.lock — must be committed for cargo audit to work

Suggested execution

git checkout -b ci/cargo-audit

1. Add a security-audit job to .github/workflows/ci.yml that installs cargo-audit and runs it from contracts/
2. Ensure contracts/Cargo.lock is committed (check .gitignore)
3. If existing advisories are acceptable, add them to audit.toml with a justification comment

Example commit message:
ci: add cargo-audit security scan for Soroban contract dependencies

Acceptance criteria

• CI job runs on every PR to main
• Job fails if a non-ignored CVE is found
• Any ignored advisories have a comment in audit.toml

---

Drips Wave · Complexity: Trivial · 100 points
Comment below to request assignment. PR must include Closes #[this issue].

[laxjovial]

@laxjovial has applied to work on this issue as part of the Stellar Wave Program's 4th wave.

Hi

Please assign me this task. I’ll add a CI job to run cargo-audit on every PR, ensure the lockfile is committed, configure handling for any acceptable advisories, and make sure the build fails on unapproved vulnerabilities.

ETA: 1–2 hours

ℹ️ Repo Maintainers: To accept this application, review their application or assign @laxjovial to this issue.

[drips-wave]

Congratulations, @laxjovial! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on April 29, 2026.

🧑‍💻 @laxjovial: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊