Audit release licenses and provenance (#104)

.gitea/workflows/supply-chain.yml

@@ -2,31 +2,7 @@ name: Dependency and supply-chain audit
 
 on:
   push:
-    paths:
-      - ".gitea/workflows/supply-chain.yml"
-      - "ci/dependency-policy.json"
-      - "deny.toml"
-      - "tools/ci-matrix/**"
-      - "docs/dependency-policy.md"
-      - "RUSTREWRITE.md"
-      - "Cargo.toml"
-      - "Cargo.lock"
-      - "crates/**/Cargo.toml"
-      - "programs/Cargo.toml"
-      - "tests/**/Cargo.toml"
   pull_request:
-    paths:
-      - ".gitea/workflows/supply-chain.yml"
-      - "ci/dependency-policy.json"
-      - "deny.toml"
-      - "tools/ci-matrix/**"
-      - "docs/dependency-policy.md"
-      - "RUSTREWRITE.md"
-      - "Cargo.toml"
-      - "Cargo.lock"
-      - "crates/**/Cargo.toml"
-      - "programs/Cargo.toml"
-      - "tests/**/Cargo.toml"
   workflow_dispatch:
 
 env:
@@ -48,6 +24,8 @@ jobs:
             ~/.cargo/advisory-dbs
           key: supply-chain-${{ runner.os }}-${{ hashFiles('Cargo.lock', 'deny.toml') }}
       - uses: dtolnay/rust-toolchain@stable
+      - name: Fetch every immutable locked package archive
+        run: cargo fetch --locked
       - name: Install pinned audit tools
         run: |
           cargo install --locked cargo-deny --version 0.20.2
@@ -57,6 +35,7 @@ jobs:
           mkdir -p artifacts
           cargo tree --locked --workspace --all-features --target all --duplicates > artifacts/dependency-duplicates.txt
           cargo run --locked -p metacrate-ci-matrix -- dependency-audit --evidence artifacts/dependency-audit.json
+          cargo run --locked -p metacrate-ci-matrix -- provenance-audit --evidence artifacts/provenance-audit.json
       - name: Reject advisories, licenses, duplicates, and sources outside policy
         run: cargo deny check advisories licenses bans sources --hide-inclusion-graph
       - name: Reject unused direct dependencies