dependencies.yaml

# SPDX-FileCopyrightText: © 2023 Foundation Devices, Inc. <hello@foundationdevices.com>
# SPDX-License-Identifier: GPL-3.0-or-later

name: Dependencies
on:
  push:
    paths:
      - '**/Cargo.toml'
      - '**/Cargo.lock'
jobs:
  pass-security-audit:
    name: Pass security audit?
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - uses: ./.github/actions/rust-toolchain
        with:
          toolchain: 1.66
      - run: cargo install --locked cargo-audit
      - run: cargo audit

  are-dependencies-sorted:
    name: Are the dependencies sorted?
    needs: [pass-security-audit]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - uses: ./.github/actions/rust-toolchain
        with:
          toolchain: 1.66
      - run: cargo install --locked cargo-sort
      - run: cargo sort --workspace --check

  are-versions-really-minimal:
    name: Are versions really minimal?
    needs: [pass-security-audit]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - uses: ./.github/actions/rust-toolchain
        with:
          toolchain: nightly
      - run: rustup override set nightly
      # proc-macro2 is broken in recent nightly versions of Rust as it
      # automagically enables some nightly features that don't exist on recent
      # nightly compilers.
      #
      # Once our dependencies update the proc-macro2 version used to be higher
      # than the one pinned here we can remove this hack.
      #
      # This is not needed for stable versions.
      - run: cargo update -p proc-macro2 --precise 1.0.66 -Z minimal-versions
      - run: cargo check -Z minimal-versions