Secure GSBot TLS dependencies and enforce its build and audit

Author: hyperpolymath

.github/workflows/casket-pages.yml

@@ -61,7 +61,7 @@ jobs:
 
       - name: Build casket-ssg
         working-directory: .casket-ssg
-        run: cabal build
+        run: cabal build --index-state=2026-09-06T00:00:00Z
 
       - name: Prepare site source
         shell: bash
@@ -109,7 +109,7 @@ jobs:
       - name: Build site
         run: |
           mkdir -p _site
-          cd .casket-ssg && cabal run casket-ssg -- build ../.site-src ../_site
+          cd .casket-ssg && cabal run --index-state=2026-09-06T00:00:00Z casket-ssg -- build ../.site-src ../_site
           touch ../_site/.nojekyll
 
       - name: Setup Pages

.github/workflows/rust.yml

@@ -59,3 +59,25 @@ jobs:
         with:
           persist-credentials: false
       - run: bash scripts/tests/dispatch-paths.sh
+
+  gsbot:
+    name: GSBot build, tests and dependency security
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    defaults:
+      run:
+        working-directory: bots/gsbot
+    steps:
+      - uses: actions/checkout@v7.0.1
+        with:
+          persist-credentials: false
+      - name: Install native TLS build dependencies
+        run: sudo apt-get update && sudo apt-get install -y pkg-config libssl-dev
+      - name: Build and test SQLite services
+        run: cargo test --locked --all-targets
+      - name: Install dependency graph auditor
+        run: cargo install cargo-deny --version 0.20.2 --locked
+      - name: Audit enabled dependencies (no advisory exclusions)
+        # Poise's unmaintained derive macro is reported as maintenance debt;
+        # vulnerabilities, unsoundness and yanked crates remain blocking.
+        run: cargo deny --locked --config deny.toml check advisories --warn unmaintained