name: "Cargo Deny"
on:
  push:
    paths:
      # Run if workflow changes
      - '.github/workflows/cargo-deny.yml'
      # Run on changed dependencies
      - '**/Cargo.toml'
      - '**/Cargo.lock'
      # Run if the configuration file changes
      - 'deny.toml'
  # Rerun periodically to pick up new advisories
  schedule:
    - cron: '0 0 * * *'
  # Run manually
  workflow_dispatch:

jobs:
  deny:
    runs-on: ubuntu-latest
    if: github.repository == 'block/goose'
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v4
      # https://github.com/EmbarkStudios/cargo-deny-action v2.0.15
      - uses: EmbarkStudios/cargo-deny-action@3fd3802e88374d3fe9159b834c7714ec57d6c979
        with:
          command: check advisories