Add cargo audit check for Rust apps

[yogh333]

No description provided.

[Copilot]

Pull request overview

Adds a new reusable GitHub Actions check to run cargo audit for Rust-based Ledger apps, and wires it into the existing guidelines enforcer so Rust apps are automatically scanned for vulnerable dependencies.

Changes:

• Added a new reusable workflow (_check_cargo_audit.yml) that checks out the app repo and runs cargo audit.
• Integrated the new cargo-audit check into reusable_guidelines_enforcer.yml for Rust apps only.
• Documented the addition in CHANGELOG.md (v1.105.0).

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
CHANGELOG.md	Documents the new cargo audit workflow addition.
.github/workflows/reusable_guidelines_enforcer.yml	Dispatches the new cargo audit check when is_rust == 'true'.
.github/workflows/_check_cargo_audit.yml	New reusable workflow that clones the app repository and runs cargo audit.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[iartemov-ledger]

There seems to be an issue with cargo-bins/cargo-binstall.

[iartemov-ledger]

FYI it already fails for app-starknet in terms of audit: https://github.com/LedgerHQ/app-starknet/actions/runs/29029564293/job/86158413411?pr=66 ;)

[tdejoigny-ledger]

@yogh333 could we run this for all rust app to have an idea of the impact ?

[yogh333]

I am wondering if it shouldn't be put as a separate workflow (reusable_cargo_audit.yml or reusable_security_enforcer.yml) that will be called specifically by Rust apps. Adding it in reusable_guidelines_enforcer.yml is maybe too overkill, and is it really the right place?
WDYT?
@tdejoigny-ledger @iartemov-ledger

[yogh333]

For your information here is the list of impacted Rust apps:

app-starknet => fixed
app-zcash
app-iota-rebased

[iartemov-ledger]

I am wondering if it shouldn't be put as a separate workflow (reusable_cargo_audit.yml or reusable_security_enforcer.yml) that will be called specifically by Rust apps. Adding it in reusable_guidelines_enforcer.yml is maybe too overkill, and is it really the right place? WDYT? @tdejoigny-ledger @iartemov-ledger

• @mbrousset-ledger