dependency-check.yaml

name: Dependency Check

on:
  pull_request:
    types: [opened, reopened, synchronize]
  merge_group:
  push:
    branches:
      - main
      - 'support/**'
  schedule:
    # Run weekly on Sundays to check for new advisories
    - cron: '0 0 * * 0'

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  CARGO_INCREMENTAL: 0
  CARGO_NET_RETRY: 10
  CI: 1
  RUST_BACKTRACE: short
  RUSTUP_MAX_RETRIES: 10
  RUST_CHANNEL: '1.91.1'
  CARGO_DENY_VERSION: '0.19.0'

jobs:
  check-dependencies:
    name: Check Dependencies
    timeout-minutes: 10
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          ref: ${{ github.event.pull_request.head.sha }}

      - name: Install Rust toolchain
        run: |
          rustup update --no-self-update ${{ env.RUST_CHANNEL }}
          rustup default ${{ env.RUST_CHANNEL }}

      - name: Cache cargo-deny
        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
        id: cargo_deny_cache
        with:
          path: ~/.cargo/bin/cargo-deny
          key: cargo-deny-${{ env.CARGO_DENY_VERSION }}-${{ runner.os }}

      - name: Install cargo-deny
        if: steps.cargo_deny_cache.outputs.cache-hit != 'true'
        run: cargo install --locked cargo-deny --version ${{ env.CARGO_DENY_VERSION }}

      - name: Install Just
        run: sudo snap install --edge --classic just

      - name: Run dependency checks
        run: |
          just check-deps