supply-chain.yml

name: Supply Chain

# cargo-deny + cargo-audit on every PR and on a weekly cron, so a
# late-breaking advisory in a transitive dep is caught even when we
# aren't merging code.
on:
  pull_request:
    paths:
      - "Cargo.toml"
      - "Cargo.lock"
      - "crates/**/Cargo.toml"
      - "deny.toml"
      - "supply-chain/**"
      - ".github/workflows/supply-chain.yml"
  schedule:
    - cron: "0 6 * * 1"   # Monday 06:00 UTC
  workflow_dispatch:

concurrency:
  group: supply-chain-${{ github.ref }}
  cancel-in-progress: true

jobs:
  cargo-deny:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Run cargo-deny
        uses: EmbarkStudios/cargo-deny-action@v2
        with:
          command: check advisories licenses bans sources

  cargo-audit:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
      - name: Run cargo-audit
        uses: rustsec/audit-check@v2
        with:
          token: ${{ secrets.GITHUB_TOKEN }}