name: lockfiles

# Every committed Cargo.lock is current: cargo would not change it.
#
# The workspaces in this tree depend on one another by path. A version bump in
# one leaves the lockfiles of its dependents behind, and nothing says so until
# a job that passes `--locked` fails on a change that never touched it. This
# job says so on the change that caused it, in about a minute: it resolves each
# workspace against its lock (scripts/check-lockfiles.sh), downloading no crate
# and building nothing.
#
# No `paths:` filter, on purpose. On this forge a filter matches the files of
# the push, not of the pull request, so a later push that touches no manifest
# would leave the head with no run of this check, and a stale lock would merge
# under a green list. The job is short enough to run on every push.

# One run per branch at a time. A push supersedes the run before it.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

on:
  push:
    branches: [main]
  pull_request:

jobs:
  current:
    name: every Cargo.lock is current
    runs-on: linux
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v4

      # The docker runner ships no Rust, so rustup is bootstrapped.
      - name: Install Rust 1.98.0
        shell: bash
        run: |
          export PATH="$HOME/.cargo/bin:$PATH"
          command -v rustup >/dev/null 2>&1 || \
            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain 1.98.0
          rustup toolchain install 1.98.0 --profile minimal
          rustup default 1.98.0
          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"

      # The check must be able to fail, or it is decoration.
      - name: The check fails closed (self-test)
        run: ./scripts/check-lockfiles-selftest.sh

      - name: Every Cargo.lock is current
        run: ./scripts/check-lockfiles.sh