name: CI / Security
on:
  workflow_call:
    inputs:
      rust:
        required: true
        type: boolean
    outputs:
      security_result:
        value: ${{ jobs.results.outputs.security_result }}

env:
  CARGO_TERM_COLOR: always
  BUZZ_TEST_POSTGRES_PASSWORD: buzz_dev
  PLAYWRIGHT_BROWSERS_PATH: ${{ github.workspace }}/.cache/ms-playwright

jobs:
  security:
    name: Security
    runs-on: ubuntu-latest
    timeout-minutes: 20
    if: github.event_name == 'push' || inputs.rust
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1
      - name: Dependency policy
        run: cargo-deny check


  results:
    name: Results
    if: ${{ always() }}
    needs: [security]
    runs-on: ubuntu-latest
    timeout-minutes: 5
    permissions: {}
    outputs:
      security_result: ${{ needs.security.result }}
    steps:
      - run: echo "Captured Security job results"