deny.yml

name: cargo-deny
on:
    push:
      paths-ignore:
        - "**.md"
    pull_request:
      paths-ignore:
        - "**.md"
  
jobs:
  cargo-deny:
    runs-on: ubuntu-20.04
    strategy:
      matrix:
        checks:
          - advisories
          - sources
          - bans

    # Prevent sudden announcement of a new advisory from failing ci:
    continue-on-error: ${{ matrix.checks == 'sources' }}

    steps:
    - name: Harden Runner
      uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 # v2.8.1
      with:
        egress-policy: audit

    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
    - run: git config --global http.postBuffer 524288000
    - run: git config --global   http.sslVerify "false"
    - run: git submodule update --init --recursive --depth 1
    - run: bash sh_script/pre-build.sh
    - uses: EmbarkStudios/cargo-deny-action@3f4a782664881cf5725d0ffd23969fcce89fd868 # v1.6.3
      with:
        command: check ${{ matrix.checks }}