name: Dependency Checks

on:
  pull_request:
    paths:
      - frontend/pnpm-lock.yaml
      - desktop/pnpm-lock.yaml

permissions:
  contents: read
  pull-requests: write

jobs:
  diff_dependencies:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        directory: [frontend, desktop]
    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
      - name: Create Diff
        uses: e18e/action-dependency-diff@9a7f09f5f2993256322e0db17ee4c8d9339dab77 # v1.7.1
        with:
          working-directory: ${{ matrix.directory }}
          duplicate-threshold: 9999

  check-provenance:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        directory: [frontend, desktop]
    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
      - name: Check provenance downgrades
        uses: danielroe/provenance-action@2fb14fee22c121d116b029b81359a9afeaf56fe2 # main
        with:
          workspace-path: ${{ matrix.directory }}
          fail-on-provenance-change: true