Separate Rust advisory scanning from quality checks

.github/workflows/rust.yaml

@@ -32,7 +32,22 @@ env:
   CARGO_INCREMENTAL: "0"
 
 jobs:
+  advisories:
+    name: Rust advisories
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    steps:
+      - uses: actions/checkout@v7
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: taiki-e/install-action@v2
+        with:
+          tool: cargo-deny@0.20.2
+      - name: Check security advisories
+        run: make check/rust/advisories
+
   quality:
+    name: Rust quality
     runs-on: ubuntu-latest
     timeout-minutes: 20
 

Makefile

@@ -289,9 +289,13 @@ check/js/package: build/js
 	pnpm -C js run migration:legacy
 	pnpm -C js run package:check
 
+.PHONY: check/rust/advisories
+check/rust/advisories: ## Audit Rust dependencies against the advisory database
+	cd rust && cargo deny check advisories
+
 .PHONY: check/rust/dependencies
-check/rust/dependencies: ## Audit Rust advisories, licenses, bans, and sources
-	cd rust && cargo deny check
+check/rust/dependencies: ## Check Rust dependency licenses, bans, and sources
+	cd rust && cargo deny check bans licenses sources
 
 # Cargo caches temporary registry dependencies by path and version. A fresh
 # build directory prevents stale sources and binaries after same-version edits.