dependencies.yaml

---
name: dependencies

"on":
  pull_request:
    paths:
      - Cargo.lock
      - Cargo.toml
      - "**/Cargo.toml"
      - config/deny.toml
      - config/osv-scanner.toml
      - .github/workflows/dependencies.yaml
      - .github/actions/install-mise/**
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: "${{ github.workflow }}-${{ github.ref }}"
  cancel-in-progress: ${{ startsWith(github.ref, 'refs/pull/') }}

defaults:
  run:
    shell: bash --noprofile --norc -euo pipefail {0}

env:
  MISE_ENV: dart,dotnet,java,js,python,rust,zig

jobs:
  dependencies:
    # Use `ubuntu-latest`, not `ubuntu-slim`, for this workflow.
    # Although every step here is metadata/network-bound (no Rust compile), `taiki-e/install-action` itself assumes
    # a standard runner-image FHS (e.g. ~/.cargo/bin) and fails on slim's bare container with
    # `I/O Error: No such file or directory` while staging cargo-unmaintained. Slim only fits workflows whose first
    # step doesn't need that scaffolding.
    runs-on: ubuntu-latest
    timeout-minutes: 25
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 1
          persist-credentials: false

      - name: Install mise + dependency-scan tools
        uses: ./.github/actions/install-mise
        with:
          install-action-tools: cargo-deny,cargo-unmaintained,coreutils,osv-scanner,ripgrep

      - name: Generate config/osv-scanner.toml from config/deny.toml
        run: mise run gen:osv-scanner

      - name: cargo deny check
        run: mise run cargo-deny-check

      - name: osv-scanner
        run: mise run osv-scanner

      # Restore cached `cargo unmaintained` lookups to keep reruns fast.
      # `cargo unmaintained` persists per-repository archival/last-commit lookups under
      # `$XDG_CACHE_HOME/cargo-unmaintained` (default `~/.cache/cargo-unmaintained`, with a versioned `v2/` subdir).
      # On a cold runner the per-dependency GitHub round-trips take ~12 min, which nearly blew the old 15-min
      # timeout. Key on Cargo.lock so a dependency change refreshes; the prefix restore-key reuses the previous
      # cache for crates that didn't change.
      - name: Cache cargo-unmaintained lookups
        uses: actions/cache@v4
        with:
          path: ~/.cache/cargo-unmaintained
          key: cargo-unmaintained-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: |
            cargo-unmaintained-

      # Provide a token so `cargo unmaintained` can run its archival check.
      # `cargo unmaintained` queries the GitHub API to check whether each declared upstream repository is
      # archived. Without a token the archival check is skipped with a warning, leaving an unmaintained archived
      # crate undetected.
      - name: cargo unmaintained
        env:
          GITHUB_TOKEN: ${{ github.token }}
        run: mise run cargo-unmaintained-check

      - name: Check config/osv-scanner.toml is committed
        run: git diff --exit-code -- config/osv-scanner.toml