name: Rust CI

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main

permissions:
  contents: read

# Enable CodeQL through GitHub's default setup in repository settings. Do not
# add an advanced CodeQL workflow while default setup is active.
env:
  CARGO_TERM_COLOR: always
  RUST_BACKTRACE: 1

jobs:
  checks:
    name: Format, lint, test, and audit
    runs-on: ubuntu-latest
    timeout-minutes: 30

    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Install Rust toolchain
        run: rustup show

      - name: Cache Rust build output
        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
        with:
          cache-on-failure: true

      - name: Install security tools
        uses: taiki-e/install-action@c7eb1735f09259a5035e8e5d44b1406b1cddc0fb # v2.83.0
        with:
          tool: cargo-deny,cargo-audit

      - name: Run project checks
        run: scripts/checks.sh
