v0.0.9 — Enterprise readiness: 4-crate workspace, multi-algo verify+rehash, KMS pepper, FIPS contract, CLI #12

	name: Supply Chain

	# cargo-deny + cargo-audit on every PR and on a weekly cron, so a
	# late-breaking advisory in a transitive dep is caught even when we
	# aren't merging code.
	on:
	pull_request:
	paths:
	- "Cargo.toml"
	- "Cargo.lock"
	- "crates/**/Cargo.toml"
	- "deny.toml"
	- "supply-chain/**"
	- ".github/workflows/supply-chain.yml"
	schedule:
	- cron: "0 6 * * 1" # Monday 06:00 UTC
	workflow_dispatch:

	concurrency:
	group: supply-chain-${{ github.ref }}
	cancel-in-progress: true

	jobs:
	cargo-deny:
	runs-on: ubuntu-latest
	steps:
	- name: Checkout
	uses: actions/checkout@v4
	- name: Run cargo-deny
	uses: EmbarkStudios/cargo-deny-action@v2
	with:
	command: check advisories licenses bans sources

	cargo-audit:
	runs-on: ubuntu-latest
	steps:
	- name: Checkout
	uses: actions/checkout@v4
	- name: Install Rust toolchain
	uses: dtolnay/rust-toolchain@stable
	- name: Run cargo-audit
	uses: rustsec/audit-check@v2
	with:
	token: ${{ secrets.GITHUB_TOKEN }}

Provide feedback