name: Rust CI

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main

permissions:
  contents: read

env:
  CARGO_TERM_COLOR: always
  RUST_BACKTRACE: 1

jobs:
  checks:
    name: Format, lint, test, and audit
    runs-on: ubuntu-24.04
    timeout-minutes: 45

    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Install Rust toolchain
        run: rustup show

      - name: Install security tools
        run: |
          cargo install --locked cargo-deny --version 0.19.9
          cargo install --locked cargo-audit --version 0.22.2

      - name: Run local gate
        run: scripts/checks.sh
