Harden dependency and supply-chain policy (#100)

tools/ci-matrix/src/main.rs

@@ -1,4 +1,4 @@
-use metacrate_ci_matrix::{audit, load, run, workspace_root};
+use metacrate_ci_matrix::{audit, audit_dependencies, load, run, workspace_root};
 use std::path::{Path, PathBuf};
 
 fn main() {
@@ -32,7 +32,26 @@ fn execute() -> Result<(), Box<dyn std::error::Error>> {
             run(&root, &matrix, &profile, &evidence)?;
             println!("release CI profile {profile}: ok ({})", evidence.display());
         }
-        _ => return Err("usage: ci-matrix audit | run PROFILE --evidence FILE".into()),
+        Some("dependency-audit") => {
+            let flag = arguments
+                .next()
+                .ok_or("dependency-audit requires --evidence FILE")?;
+            let evidence = arguments
+                .next()
+                .ok_or("dependency-audit requires --evidence FILE")?;
+            if flag != "--evidence" || arguments.next().is_some() {
+                return Err("usage: ci-matrix dependency-audit --evidence FILE".into());
+            }
+            let evidence = absolute_or_rooted(&root, &evidence);
+            audit_dependencies(&root, &evidence)?;
+            println!("dependency policy: ok ({})", evidence.display());
+        }
+        _ => {
+            return Err(
+                "usage: ci-matrix audit | run PROFILE --evidence FILE | dependency-audit --evidence FILE"
+                    .into(),
+            );
+        }
     }
     Ok(())
 }