name: Cargo Deny
permissions:
  contents: read

on: [push, pull_request]

jobs:
  cargo-deny:
    name: Cargo Deny
    runs-on: ubuntu-latest
    strategy:
      matrix:
        checks:
          - advisories
          - bans licenses sources

    if: ${{ github.event_name != 'pull_request' || !github.event.pull_request.draft }}
    # Prevent sudden announcement of a new advisory from failing ci:
    continue-on-error: ${{ matrix.checks == 'advisories' }}

    steps:
      - uses: actions/checkout@v6
      - uses: EmbarkStudios/cargo-deny-action@v2
        with:
          command: check ${{ matrix.checks }}
