Harden dependency and supply-chain policy (#100)

.gitea/workflows/supply-chain.yml

@@ -0,0 +1,70 @@
+name: Dependency and supply-chain audit
+
+on:
+  push:
+    paths:
+      - ".gitea/workflows/supply-chain.yml"
+      - "ci/dependency-policy.json"
+      - "deny.toml"
+      - "tools/ci-matrix/**"
+      - "docs/dependency-policy.md"
+      - "RUSTREWRITE.md"
+      - "Cargo.toml"
+      - "Cargo.lock"
+      - "crates/**/Cargo.toml"
+      - "programs/Cargo.toml"
+      - "tests/**/Cargo.toml"
+  pull_request:
+    paths:
+      - ".gitea/workflows/supply-chain.yml"
+      - "ci/dependency-policy.json"
+      - "deny.toml"
+      - "tools/ci-matrix/**"
+      - "docs/dependency-policy.md"
+      - "RUSTREWRITE.md"
+      - "Cargo.toml"
+      - "Cargo.lock"
+      - "crates/**/Cargo.toml"
+      - "programs/Cargo.toml"
+      - "tests/**/Cargo.toml"
+  workflow_dispatch:
+
+env:
+  CARGO_BUILD_JOBS: 1
+  CARGO_INCREMENTAL: 0
+  CARGO_PROFILE_DEV_DEBUG: 0
+
+jobs:
+  audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Cache immutable Cargo downloads and advisory database
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            ~/.cargo/advisory-dbs
+          key: supply-chain-${{ runner.os }}-${{ hashFiles('Cargo.lock', 'deny.toml') }}
+      - uses: dtolnay/rust-toolchain@stable
+      - name: Install pinned audit tools
+        run: |
+          cargo install --locked cargo-deny --version 0.20.2
+          cargo install --locked cargo-machete --version 0.9.2
+      - name: Record and validate the reviewed graph
+        run: |
+          mkdir -p artifacts
+          cargo tree --locked --workspace --all-features --target all --duplicates > artifacts/dependency-duplicates.txt
+          cargo run --locked -p metacrate-ci-matrix -- dependency-audit --evidence artifacts/dependency-audit.json
+      - name: Reject advisories, licenses, duplicates, and sources outside policy
+        run: cargo deny check advisories licenses bans sources --hide-inclusion-graph
+      - name: Reject unused direct dependencies
+        run: cargo machete --with-metadata
+      - name: Upload dependency evidence
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: supply-chain-evidence
+          path: artifacts/
+          if-no-files-found: error