name: cargo-deny

# Enforce the supply-chain policy in deny.toml (advisories / bans / licenses /
# sources) on every push to main and every PR. Runs on a *locked* tree so the
# pinned, vetted versions in Cargo.lock are exactly what get audited — see the
# deny.toml header and VERSIONING.md. A new poisoned release of a dependency
# cannot reach CI until Cargo.lock is deliberately updated.

on:
  push:
    branches: [main]
  pull_request:

jobs:
  cargo-deny:
    runs-on: ubuntu-latest
    # rust:1 provides the cargo toolchain that cargo-deny shells out to for
    # `cargo metadata`. Adjust the runner label if your act_runner uses a
    # different one.
    container: rust:1
    steps:
      - uses: actions/checkout@v4

      - name: Install cargo-deny (pinned prebuilt)
        run: |
          set -euo pipefail
          version=0.19.9
          curl -sSfL \
            "https://github.com/EmbarkStudios/cargo-deny/releases/download/${version}/cargo-deny-${version}-x86_64-unknown-linux-musl.tar.gz" \
            | tar -xz -C /usr/local/bin --strip-components=1 --wildcards '*/cargo-deny'
          cargo-deny --version

      - name: cargo deny check
        run: cargo deny --locked check