# Supply-chain vetting (cargo-vet) — engineering-standards README §7.
# Bootstrap phase: non-blocking (continue-on-error) until the audit backlog
# is burned down; flip to blocking once exemptions are pruned.
name: vet
on:
push:
branches:
paths:
- "Cargo.lock"
- "Cargo.toml"
- "supply-chain/**"
pull_request:
paths:
- "Cargo.lock"
- "Cargo.toml"
- "supply-chain/**"
schedule:
# Weekly, Monday 06:00 UTC — catches newly-published audit failures.
- cron: "0 6 * * 1"
jobs:
vet:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: dtolnay/rust-toolchain@stable
- name: install cargo-vet
run: cargo install --locked cargo-vet || true
- name: cargo vet (non-blocking during bootstrap)
run: cargo vet --locked
continue-on-error: true