| 1 | name: cargo-deny |
| 2 | |
| 3 | permissions: {} |
| 4 | |
| 5 | on: |
| 6 | pull_request: |
| 7 | paths: |
| 8 | - '.github/workflows/cargo-deny.yml' |
| 9 | - '**/Cargo.toml' |
| 10 | - '**/Cargo.lock' |
| 11 | - 'deny.toml' |
| 12 | push: |
| 13 | branches: [main, master] |
| 14 | schedule: |
| 15 | # Run weekly on Monday at 06:31 UTC |
| 16 | - cron: '31 6 * * 1' |
| 17 | |
| 18 | env: |
| 19 | CARGO_TERM_COLOR: always |
| 20 | |
| 21 | jobs: |
| 22 | deny: |
| 23 | name: cargo-deny |
| 24 | runs-on: ubuntu-latest |
| 25 | strategy: |
| 26 | matrix: |
| 27 | checks: |
| 28 | - advisories |
| 29 | - bans licenses sources |
| 30 | # Prevent sudden announcement of a new advisory from failing CI |
| 31 | continue-on-error: ${{ matrix.checks == 'advisories' }} |
| 32 | steps: |
| 33 | - uses: actions/checkout@v7 |
| 34 | # rust-toolchain.toml pins `channel = "stable"` with no target, so |
| 35 | # inside the action's alpine (musl) container rustup resolves it to |
| 36 | # `stable-x86_64-unknown-linux-musl` — which the container does not |
| 37 | # have. Without provisioning, the action's `rustup show` step prints |
| 38 | # "error: override toolchain 'stable-x86_64-unknown-linux-musl' is not |
| 39 | # installed" and then auto-installs mid-run (network-dependent ~12s |
| 40 | # detour, hard failure if the download stalls). `rust-version` makes the |
| 41 | # entrypoint run `rustup default stable` (same musl host triple) before |
| 42 | # cargo-deny touches the workspace, so the toolchain file resolves to an |
| 43 | # already-installed toolchain on every run. |
| 44 | - uses: EmbarkStudios/cargo-deny-action@v2 |
| 45 | with: |
| 46 | command: check ${{ matrix.checks }} |
| 47 | rust-version: stable |
| 48 |