deny.yml

name: "deny"

permissions: {}

on:
  pull_request:

env:
  CARGO_TERM_COLOR: always

jobs:
  cargo-deny:
    name: "cargo deny"
    permissions:
      contents: read
    runs-on: ubuntu-22.04
    strategy:
      matrix:
        checks:
          - advisories
          - bans licenses sources

    # Prevent sudden announcement of a new advisory from failing ci:
    continue-on-error: ${{ matrix.checks == 'advisories' }}

    steps:
    - uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v2.6.0
      with:
        egress-policy: audit

    - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

    - id: toolchain
      uses: dtolnay/rust-toolchain@439cf607258077187679211f12aa6f19af4a0af7 # doesn't have usual versioned releases/tags
      with:
        toolchain: "stable"

    - uses: Swatinem/rust-cache@3cf7f8cc28d1b4e7d01e3783be10a97d55d483c8 # v2.7.1

    - uses: taiki-e/install-action@11dea51b35bc2bfa42820716c6cabb14fd4c3266 # v2.21.7
      with:
        tool: cargo-deny@0.14.3

    - run: cargo +${{ steps.toolchain.outputs.name }} deny --log-level info --all-features check ${{ matrix.checks }}