name: Dependency and supply-chain audit

on:
  push:
    paths:
      - ".gitea/workflows/supply-chain.yml"
      - "ci/dependency-policy.json"
      - "deny.toml"
      - "tools/ci-matrix/**"
      - "docs/dependency-policy.md"
      - "RUSTREWRITE.md"
      - "Cargo.toml"
      - "Cargo.lock"
      - "crates/**/Cargo.toml"
      - "programs/Cargo.toml"
      - "tests/**/Cargo.toml"
  pull_request:
    paths:
      - ".gitea/workflows/supply-chain.yml"
      - "ci/dependency-policy.json"
      - "deny.toml"
      - "tools/ci-matrix/**"
      - "docs/dependency-policy.md"
      - "RUSTREWRITE.md"
      - "Cargo.toml"
      - "Cargo.lock"
      - "crates/**/Cargo.toml"
      - "programs/Cargo.toml"
      - "tests/**/Cargo.toml"
  workflow_dispatch:

env:
  CARGO_BUILD_JOBS: 1
  CARGO_INCREMENTAL: 0
  CARGO_PROFILE_DEV_DEBUG: 0

jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Cache immutable Cargo downloads and advisory database
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            ~/.cargo/advisory-dbs
          key: supply-chain-${{ runner.os }}-${{ hashFiles('Cargo.lock', 'deny.toml') }}
      - uses: dtolnay/rust-toolchain@stable
      - name: Install pinned audit tools
        run: |
          cargo install --locked cargo-deny --version 0.20.2
          cargo install --locked cargo-machete --version 0.9.2
      - name: Record and validate the reviewed graph
        run: |
          mkdir -p artifacts
          cargo tree --locked --workspace --all-features --target all --duplicates > artifacts/dependency-duplicates.txt
          cargo run --locked -p metacrate-ci-matrix -- dependency-audit --evidence artifacts/dependency-audit.json
      - name: Reject advisories, licenses, duplicates, and sources outside policy
        run: cargo deny check advisories licenses bans sources --hide-inclusion-graph
      - name: Reject unused direct dependencies
        run: cargo machete --with-metadata
      - name: Upload dependency evidence
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: supply-chain-evidence
          path: artifacts/
          if-no-files-found: error