name: Rust CI

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main

permissions:
  contents: read

# Enable CodeQL through GitHub's default setup in repository settings. Do not
# add an advanced CodeQL workflow while default setup is active.
env:
  CARGO_TERM_COLOR: always
  RUST_BACKTRACE: 1

jobs:
  checks:
    name: Format, lint, test, and audit
    runs-on: ubuntu-latest
    timeout-minutes: 30

    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Install Rust toolchain
        run: rustup show

      - name: Cache Rust build output
        uses: Swatinem/rust-cache@42dc69e1aa15d09112580998cf2ef0119e2e91ae # v2
        with:
          cache-on-failure: true

      - name: Install security tools
        uses: taiki-e/install-action@3235f8901fd37ffed0052b276cec25a362fb82e9 # v2
        with:
          tool: cargo-deny,cargo-audit

      - name: Run project checks
        run: scripts/checks.sh
