name: cargo-deny

on:
  workflow_call:

jobs:
  cargo-deny:
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: ./codex-rs
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - uses: ./.github/actions/setup-ci

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@d124f86f28ff42855784ff3319f48ac182c248f8 # 1.99.1

      - name: Run cargo-deny
        uses: EmbarkStudios/cargo-deny-action@82eb9f621fbc699dd0918f3ea06864c14cc84246 # v2
        with:
          rust-version: 1.99.1
          manifest-path: ./codex-rs/Cargo.toml

      - name: Check for a clean worktree
        if: always() && !cancelled()
        uses: ./.github/actions/check-clean-worktree