add cargo-deny to CI (#59)

* add cargo-deny to CI

* automerge dependabot PRs

* add lockfile to VCS

---------

Co-authored-by: daniel.eades <daniel.eades@hotmail.com>

.gitattributes

@@ -0,0 +1 @@
+Cargo.lock binary

.github/dependabot.yml

@@ -3,7 +3,7 @@ updates:
 - package-ecosystem: cargo
   directory: "/"
   schedule:
-    interval: daily
+    interval: monthly
 - package-ecosystem: github-actions
   directory: "/"
   schedule:

.github/workflows/CI.yml

@@ -64,3 +64,22 @@ jobs:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@stable
       - run: cargo doc --no-deps
+
+  cargo-deny:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+    - uses: EmbarkStudios/cargo-deny-action@v1
+
+  # Automatically merge if it's a Dependabot PR that passes the build
+  dependabot:
+    runs-on: ubuntu-latest
+    if: github.actor == 'dependabot[bot]'
+    needs: [test, fmt, clippy, docs, cargo-deny]
+    steps:
+      - uses: actions/checkout@v4
+      - name: Auto-merge Dependabot PRs
+        # Find the PR number based on the current branch name, and squash merge based on this number
+        run: 'PR_NUM="$(gh pr list | grep $(git branch --show-current) | cut -f1)"; gh pr merge --auto --squash $PR_NUM'
+        env:
+          GH_TOKEN: ${{secrets.GITHUB_TOKEN}}

.gitignore

@@ -1,3 +1,2 @@
 /target
 **/*.rs.bk
-Cargo.lock