ci: install prebuilt cargo-deny instead of compiling from source

[natoscott]

Problem

The Cargo Deny job is failing on every open PR (the failure is in building the linter, so it's independent of PR content; main shows a stale green from its last run). It runs:

cargo-deny --version || cargo install cargo-deny@0.19.0

cargo install compiles cargo-deny and its whole dependency tree from source, and that build now fails on the transitive crate tinyvec:

error: cannot find macro `vec` in this scope        (tinyvec/…/lib.rs:710)
note: `vec` is imported here, but it is a module, not a macro
      use alloc::vec::{self, Vec};
error: could not compile `tinyvec` (lib) due to 1 previous error
error: failed to compile `cargo-deny v0.19.0`

tinyvec's use alloc::vec::{self, Vec} shadows the vec! macro, which is a hard error under the runner's current Rust toolchain — so cargo-deny never builds and the check can't run.

Fix

Install the pinned prebuilt cargo-deny 0.19.0 binary via taiki-e/install-action instead of compiling from source. Same version, same cargo-deny … check command — it just skips the source build, so the tinyvec breakage no longer applies. The action is SHA-pinned per repo convention.

Notes

• No change to the deny ruleset, version, or checks performed.
• Unblocks Cargo Deny for all open PRs.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated the dependency license and bans validation workflow to use a pinned tool version.
  • Improved consistency and reliability of automated checks across builds.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: ee7a1124-1303-489f-85a4-501e5c602e62

📥 Commits

Reviewing files that changed from the base of the PR and between 77fd077 and 710eb75.

📒 Files selected for processing (1)

• .github/workflows/build-test.yml

Included review availability: Your plan provides up to 12 included reviews per hour; 9 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (2)

• GitHub Check: Collect snapshot (new)
• GitHub Check: Collect snapshot (old)

🧰 Additional context used

📓 Path-based instructions (2)

Review workflow edits for least-privilege permissions, safe trigger scopes, secret exposure, fork behavior, and release/cherry-pick side effects.

⚙️ CodeRabbit configuration file

Files:

• .github/workflows/build-test.yml

Repository rules must require the `codeowners` check to be merge-blocking.

📄 CodeRabbit inference engine (AGENTS.md)

Files:

• .github/workflows/build-test.yml

🔇 Additional comments (1)

.github/workflows/build-test.yml (1)

30-44: LGTM!

---

Walkthrough

The CI workflow now installs pinned cargo-deny version 0.19.0 from a prebuilt binary and runs license and bans checks directly.

Changes

CI cargo-deny execution

Layer / File(s)	Summary
Pin and run cargo-deny .github/workflows/build-test.yml	The workflow uses taiki-e/install-action to install cargo-deny version 0.19.0. It then runs cargo-deny --all-features check --show-stats licenses bans without a fallback compilation step.

Estimated code review effort: 2 (Simple) | ~5 minutes

Merge Risk: ⚪ Minimal · up to 710eb

CI now installs the pinned cargo-deny binary instead of compiling it, retaining the same dependency license and ban checks while avoiding the runner toolchain compilation failure. The change is ready to merge.

Poem

A pinned tool arrives,
Prebuilt and ready to run,
Licenses are checked,
Bans stand in the gate,
The workflow moves with less toil.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly states the main CI change: it replaces source compilation with a prebuilt cargo-deny installation.
Description check	✅ Passed	The description clearly explains the failure, the prebuilt-binary fix, preserved behavior, and SHA pinning. It does not use the repository template headings or provide a reviewer-start location or rel…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description clearly explains the failure, the prebuilt-binary fix, preserved behavior, and SHA pinning. It does not use the repository template headings or provide a reviewer-start location or related issue, but it contains the main information needed for review.

---

_{Comment @coderabbitai help to get the list of available commands.}