peat-btle 0.3.0

name: CI

on:
  push:
    branches: [main, transfer]
  pull_request:
  workflow_call:

permissions:
  contents: read

env:
  CARGO_TERM_COLOR: always

jobs:
  fmt:
    name: Format
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt
      - run: cargo fmt --check

  clippy:
    name: Clippy
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy
      - uses: Swatinem/rust-cache@v2
      - run: cargo clippy -- -D warnings

  test:
    name: Test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - run: cargo test --lib

  audit:
    name: Security Audit
    continue-on-error: true
    runs-on: ubuntu-latest
    # `rustsec/audit-check` posts results as a GitHub Check Run. Without
    # `checks: write` on the job, the API call fails with
    # "Resource not accessible by integration" and the job exits non-zero
    # even when the underlying `cargo audit` finds zero vulnerabilities.
    # The release workflow (`workflow_call: ./.github/workflows/ci.yml`)
    # carries `contents: read` only, which is what triggered the failure
    # on the v0.3.0 tag run; granting the narrower permission here keeps
    # the rest of the release workflow at `contents: read`.
    permissions:
      contents: read
      checks: write
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - run: cargo generate-lockfile
      - uses: rustsec/audit-check@v2.0.0
        with:
          token: ${{ secrets.GITHUB_TOKEN }}