name: Supply chain

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main
  merge_group:
  schedule:
    - cron: "41 2 * * 1"
  workflow_dispatch:

permissions:
  contents: read

jobs:
  cargo-deny:
    name: cargo-deny ${{ matrix.checks }}
    runs-on: ubuntu-latest
    timeout-minutes: 15

    strategy:
      fail-fast: false
      matrix:
        include:
          # Advisories can appear after code was merged. Keep this visible,
          # but don't let a surprise upstream advisory nuke every unrelated PR.
          - checks: advisories
            continue-on-error: true

          # These are policy choices in this repo. They should block PRs.
          - checks: bans licenses sources
            continue-on-error: false

    continue-on-error: ${{ matrix.continue-on-error }}

    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      - name: Run cargo-deny
        uses: EmbarkStudios/cargo-deny-action@6c8f9facfa5047ec02d8485b6bf52b587b7777d1 # v2
        with:
          command: check
          arguments: --all-features
          command-arguments: ${{ matrix.checks }}

  actionlint:
    name: actionlint
    runs-on: ubuntu-latest
    timeout-minutes: 10

    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      - name: Run actionlint
        uses: raven-actions/actionlint@205b530c5d9fa8f44ae9ed59f341a0db994aa6f8 # v2
        with:
          # release.yml is generated by dist. Keep linting it for real
          # workflow issues, but ignore generated ShellCheck style/info noise.
          flags: >-
            -ignore '\.github/workflows/release\.yml:[0-9]+:[0-9]+: shellcheck reported issue .*SC2086'
            -ignore '\.github/workflows/release\.yml:[0-9]+:[0-9]+: shellcheck reported issue .*SC2129'