name: audit

# Advisories and licences. Deliberately off the per-push gate — DESIGN.md §12.
on:
  schedule:
    - cron: '17 4 * * 1'
  workflow_dispatch:

env:
  CARGO_TERM_COLOR: always

jobs:
  deny:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Build deps
        run: |
          apt-get update
          apt-get install -y --no-install-recommends \
            git curl ca-certificates build-essential pkg-config

      - name: Cache cargo
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/bin
            ~/.cargo/registry
            ~/.cargo/git
          key: ${{ runner.os }}-audit-${{ hashFiles('Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-audit-

      - name: Toolchain
        run: |
          if ! command -v cargo >/dev/null; then
            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
              | sh -s -- -y --profile minimal --no-modify-path
          fi
          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"

      - name: cargo-deny
        run: |
          export PATH="$HOME/.cargo/bin:$PATH"
          command -v cargo-deny >/dev/null || cargo install cargo-deny --locked
          cargo deny check