Add cargo audit check for Rust apps

.github/workflows/_check_cargo_audit.yml

@@ -0,0 +1,48 @@
+name: Run Cargo Audit
+
+on:
+  workflow_call:
+    inputs:
+      app_repository:
+        description: 'The URL of the app repository to check. Defaults to the workflow caller repository URL'
+        required: false
+        default: ${{ github.repository }}
+        type: string
+      relative_app_directory:
+        description: 'The relative path in the repository where the application is built from (defaults to ".")'
+        required: false
+        default: '.'
+        type: string
+
+permissions:
+  contents: read  # Needed to clone the repositories
+
+jobs:
+  cargo_audit:
+    name: Cargo Audit
+    runs-on: ubuntu-22.04
+
+    steps:
+      - name: Clone app repository
+        uses: actions/checkout@v6
+        with:
+          repository: ${{ inputs.app_repository }}
+          path: app-repository
+          submodules: recursive
+
+      - name: Set up Rust
+        uses: actions-rust-lang/setup-rust-toolchain@v1.16.1
+        with:
+          toolchain: stable
+
+      - name: Install cargo-binstall
+        uses: cargo-bins/cargo-binstall@v1.20.1
+
+      - name: Install cargo-audit
+        run: cargo binstall --no-confirm cargo-audit
+
+      - name: Run cargo audit
+        working-directory: app-repository/${{ inputs.relative_app_directory }}
+        env:
+          RUSTUP_TOOLCHAIN: stable
+        run: cargo audit

.github/workflows/reusable_guidelines_enforcer.yml

@@ -157,3 +157,12 @@ jobs:
       relative_app_directory: ${{ needs.call_get_app_metadata.outputs.build_directory }}
       is_rust: ${{ needs.call_get_app_metadata.outputs.is_rust }}
       workflows_ref: ${{ needs.call_get_workflow_version.outputs.version }}
+
+  call_check_cargo_audit:
+    name: Dispatch check
+    needs: [call_get_app_metadata]
+    if: ${{ needs.call_get_app_metadata.outputs.is_rust == 'true' }}
+    uses: ./.github/workflows/_check_cargo_audit.yml
+    with:
+      app_repository: ${{ inputs.app_repository }}
+      relative_app_directory: ${{ needs.call_get_app_metadata.outputs.build_directory }}

CHANGELOG.md

@@ -5,6 +5,12 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.106.0] - 2026-07-10
+
+### Added
+
+- `_check_cargo_audit.yml`: run cargo audit for Rust apps (audit for crates with security vulnerabilities)
+
 ## [1.105.0] - 2026-07-09
 
 ### Added