.github/workflows/audit.yml

name: Security audit

permissions:
  contents: read

on:
  pull_request:
    paths:
      - '**/Cargo.toml'
      - '**/Cargo.lock'
  push:
    branches:
    - master

jobs:
  cargo_deny:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        checks:
          - advisories
          - bans licenses sources
    steps:
    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
    - uses: EmbarkStudios/cargo-deny-action@91bf2b620e09e18d6eb78b92e7861937469acedb  # v2.0.17
      # Prevent sudden announcement of a new advisory from failing ci:
      continue-on-error: ${{ matrix.checks == 'advisories' }}
      with:
        command: check ${{ matrix.checks }}
        rust-version: stable