deny.yml

name: cargo-deny
on:
    push:
      paths-ignore:
        - "**.md"
    pull_request:
      paths-ignore:
        - "**.md"
    schedule:
        - cron: '0 0 * * *'
        
permissions:
  contents: read
  
jobs:
  cargo-deny:
    runs-on: ubuntu-20.04
    strategy:
      matrix:
        checks:
          - advisories
          - sources
          - bans

    # Prevent sudden announcement of a new advisory from failing ci:
    continue-on-error: ${{ matrix.checks == 'sources' }}

    steps:
    - name: Harden Runner
      uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
      with:
        egress-policy: audit

    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - run: git config --global http.postBuffer 524288000
    - run: git config --global   http.sslVerify "false"
    - run: git submodule update --init --recursive --depth 1
    - run: bash sh_script/pre-build.sh
    - uses: EmbarkStudios/cargo-deny-action@f87fcad0e65efa7cbdec993036c394fa9be14262 # v2.0.2
      with:
        command: check ${{ matrix.checks }}