name: Check no patch/git deps

# Reusable guard: fails if the workspace contains a `[patch]` section or any
# git dependency. These are used only transiently while co-developing an
# extracted crate (e.g. c2pa_cbor) against c2pa-rs `main`; they must be
# settled to a published crates.io version before any release can be cut,
# because crates.io requires every dependency to resolve to a published
# version. This is the mechanical enforcement of that rule.

on:
  workflow_call:
  pull_request:
    branches:
      - stable
      - 'v0.*'
      - '*-rc*'

jobs:
  check:
    name: No patch/git dependencies

    # When invoked directly on a PR, run only for trusted PRs (same-repo branch,
    # or a fork PR labeled `safe to test`/`check-release`); see tier-1a.yml for
    # why trust keys off the PR's head repository rather than
    # `author_association`. Invocations via `workflow_call` are not pull-request
    # events, so the first clause lets the reusable guard always run there.
    if: |
      github.event_name != 'pull_request' ||
      github.event.pull_request.head.repo.full_name == github.repository ||
      contains(github.event.pull_request.labels.*.name, 'safe to test') ||
      contains(github.event.pull_request.labels.*.name, 'check-release')
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # master@2026-06-30
        with:
          toolchain: stable

      - name: Fail if a [patch] section is present
        run: |
          if grep -rEn '^\[patch' --include=Cargo.toml .; then
            echo "::error::A [patch] section is present in a Cargo.toml. Settle it to a published version before releasing."
            exit 1
          fi
          echo "No [patch] sections found."

      - name: Fail if a git dependency is present
        run: |
          if cargo metadata --format-version=1 --no-deps \
               | jq -e '.. | objects | select(.source? != null and (.source | tostring | test("git\\+")))' >/dev/null; then
            echo "::error::A git dependency is present. Settle it to a published version before releasing."
            exit 1
          fi
          echo "No git dependencies found."
