refactor: deduplicate D<4 repair fallback and improve diagnostics #1241

	name: "Audit dependencies"
	on:
	push:
	paths:
	# Run if workflow changes
	- .github/workflows/audit.yml
	# Run on changed dependencies
	- "**/Cargo.toml"
	- "**/Cargo.lock"
	pull_request:
	paths:
	- "**/Cargo.toml"
	- "**/Cargo.lock"
	# Rerun periodically to pick up new advisories (weekly instead of daily)
	schedule:
	- cron: "0 6 * * 1" # Monday at 6 AM UTC
	# Run manually
	workflow_dispatch:

	# Security: Define minimal required permissions
	permissions:
	contents: read
	issues: write
	security-events: write

	jobs:
	audit:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

	- name: Install Rust toolchain
	uses: actions-rust-lang/setup-rust-toolchain@a0b538fa0b742a6aa35d6e2c169b4bd06d225a98 # v1.15.3
	with:
	cache: true
	# toolchain, components, etc. are specified in rust-toolchain.toml

	- name: Cache audit database
	uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
	with:
	path: ~/.cargo/advisory-db
	key: advisory-db-${{ github.ref_name }}-v1
	restore-keys: advisory-db-

	- name: Install cargo-audit
	run: cargo install --locked cargo-audit

	- name: Run cargo audit
	run: \|
	cargo audit --json > audit-results.json
	# Show human-readable output as well
	cargo audit
	continue-on-error: true

	- name: Upload audit results
	uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
	if: always()
	with:
	name: audit-results
	path: audit-results.json

Provide feedback