cargo-deny: Integrate into CI pipeline

Author: Turbo87

.github/workflows/ci.yml

@@ -13,6 +13,8 @@ concurrency:
   cancel-in-progress: true
 
 env:
+  # renovate: datasource=crate depName=cargo-deny versioning=semver
+  CARGO_DENY_VERSION: 0.13.9
   # renovate: datasource=crate depName=diesel_cli versioning=semver
   DIESEL_CLI_VERSION: 2.0.1
   # renovate: datasource=npm depName=pnpm
@@ -53,9 +55,15 @@ jobs:
             Cargo.toml
             rust-toolchain.toml
 
+      - uses: tj-actions/[email protected]
+        id: changed-files-rust-lockfile
+        with:
+          files: Cargo.lock
+
     outputs:
       non-js: ${{ steps.changed-files-non-js.outputs.any_modified }}
       non-rust: ${{ steps.changed-files-non-rust.outputs.any_modified }}
+      rust-lockfile: ${{ steps.changed-files-rust-lockfile.outputs.any_modified }}
 
   backend-lint:
     name: Backend / Lint
@@ -77,6 +85,23 @@ jobs:
       - run: cargo fmt --check
       - run: cargo clippy --all-targets --all-features --all
 
+  backend-dep-check:
+    name: Backend / Dependencies Check
+    runs-on: ubuntu-22.04
+    needs: changed-files
+    if: needs.changed-files.outputs.rust-lockfile == 'true'
+
+    env:
+      RUSTFLAGS: "-D warnings"
+
+    steps:
+      - uses: actions/[email protected]
+
+      - uses: Swatinem/[email protected]
+
+      - run: cargo install cargo-deny --vers ${{ env.CARGO_DENY_VERSION }}
+      - run: cargo deny check
+
   backend-test:
     name: Backend / Test
     runs-on: ubuntu-22.04