name: Supply chain
on:
push:
branches: [main]
paths:
- Cargo.lock
- Cargo.toml
- deny.toml
- .github/workflows/security.yml
pull_request:
paths:
- Cargo.lock
- Cargo.toml
- deny.toml
- .github/workflows/security.yml
schedule:
- cron: "23 6 * * 1"
workflow_dispatch:
concurrency:
group: supply-chain-${{ github.ref }}
cancel-in-progress: true
permissions:
contents: read
jobs:
cargo-deny:
name: Advisories, licenses, bans, sources
runs-on: ubuntu-latest
timeout-minutes: 15
steps:
- name: Check out source
uses: actions/checkout@v7
with:
persist-credentials: false
- name: Install stable Rust
run: rustup toolchain install stable --profile minimal
- name: Install cargo-deny
run: cargo +stable install cargo-deny --locked --version 0.19.4
- name: Check dependency policy
run: cargo +stable deny check