name: Rust core

on:
  pull_request:
    paths:
      - "Cargo.toml"
      - "Cargo.lock"
      - "crates/vnidrop/**"
      - "Makefile"
      - "config.mk"
      - "make/**"
      - ".github/workflows/rust-core.yml"
  push:
    # Only after merge (or direct master pushes). Feature-branch work is covered
    # by pull_request so we do not run the same job twice on every PR update.
    branches:
      - master
    paths:
      - "Cargo.toml"
      - "Cargo.lock"
      - "crates/vnidrop/**"
      - "Makefile"
      - "config.mk"
      - "make/**"
      - ".github/workflows/rust-core.yml"

permissions:
  contents: read

concurrency:
  group: rust-core-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  quality:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v4
      - name: Install Rust quality components
        run: rustup component add clippy rustfmt
      - name: Check Rust core
        run: make check-rust
      - name: Install cargo-audit
        run: cargo install cargo-audit --locked
      - name: Audit Rust dependencies
        # Ignores are listed in .cargo/audit.toml for known transitive issues.
        run: make audit-rust