---
name: Rust - Supply chain
on:
  pull_request:
    paths:
      - .github/workflows/rust-supply-chain.yml
      - deny.toml
      - '**/Cargo.toml'
      - Cargo.lock
      - '**/*.rs'
  workflow_dispatch:

permissions: {}

jobs:
  check-supply-chain:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Checkout wireguard-go submodule
        run: git submodule update --init --depth=1 wireguard-go-rs

      - name: Run cargo deny
        uses: EmbarkStudios/cargo-deny-action@v1
        with:
          log-level: warn
          rust-version: stable
          command: check all