name: Supply chain

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main
  schedule:
    - cron: "41 2 * * 1"
  workflow_dispatch:

permissions:
  contents: read

env:
  ACTIONLINT_VERSION: 1.7.7
  CARGO_DENY_VERSION: 0.20.2
  CARGO_DENY_SHA256: 9f12ed4c49936e09b48bf862b595cde2fe64fcbd9d74dfacac6131ca824c8d5f
  ACTIONLINT_SHA256: 023070a287cd8cccd71515fedc843f1985bf96c436b7effaecce67290e7e0757

jobs:
  cargo-deny:
    name: cargo-deny ${{ matrix.checks }}
    runs-on: ubuntu-latest
    timeout-minutes: 15

    strategy:
      fail-fast: false
      matrix:
        include:
          # Advisories can appear after code was merged. Keep this visible,
          # but don't let a surprise upstream advisory nuke every unrelated PR.
          - checks: advisories
            continue-on-error: true

          # These are policy choices in this repo. They should block PRs.
          - checks: bans licenses sources
            continue-on-error: false

    continue-on-error: ${{ matrix.continue-on-error }}

    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

      - name: Install cargo-deny
        run: |
          set -euo pipefail
          archive="cargo-deny-${CARGO_DENY_VERSION}-x86_64-unknown-linux-musl.tar.gz"
          curl --fail --show-error --location --retry 3 \
            "https://github.com/EmbarkStudios/cargo-deny/releases/download/${CARGO_DENY_VERSION}/${archive}" \
            --output "$archive"
          echo "${CARGO_DENY_SHA256}  ${archive}" | sha256sum --check --status -
          tar -xzf "$archive" --strip-components=1 \
            "cargo-deny-${CARGO_DENY_VERSION}-x86_64-unknown-linux-musl/cargo-deny"
          install -Dm755 cargo-deny "${RUNNER_TEMP}/bin/cargo-deny"
          echo "${RUNNER_TEMP}/bin" >> "$GITHUB_PATH"

      - name: Run cargo-deny
        run: >-
          cargo deny --manifest-path Cargo.toml --all-features check
          ${{ matrix.checks }}

  actionlint:
    name: actionlint
    runs-on: ubuntu-latest
    timeout-minutes: 10

    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

      - name: Install actionlint
        run: |
          set -euo pipefail
          archive="actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz"
          curl --fail --show-error --location --retry 3 \
            "https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}/${archive}" \
            --output "$archive"
          echo "${ACTIONLINT_SHA256}  ${archive}" | sha256sum --check --status -
          tar -xzf "$archive" actionlint
          install -Dm755 actionlint "${RUNNER_TEMP}/bin/actionlint"
          echo "${RUNNER_TEMP}/bin" >> "$GITHUB_PATH"

      - name: actionlint handwritten workflows
        # actionlint validates GitHub Actions syntax. It cannot parse Gitea's
        # required absolute action URL in interop-netem.yml, so that workflow
        # is checked by the Gitea runner instead.
        run: |
          actionlint \
            .gitea/workflows/ci.yml \
            .gitea/workflows/docker-publish.yml \
            .gitea/workflows/fuzz.yml \
            .gitea/workflows/semver.yml \
            .gitea/workflows/supply-chain.yml \
            .github/workflows/actions-security.yml \
            .github/workflows/ci-arm.yml \
            .github/workflows/osv-scanner.yml \
            .github/workflows/rust-clippy.yml

      - name: actionlint generated release workflow
        run: >-
          actionlint -shellcheck= .github/workflows/irtt-rs-release.yml