chore: add cargo-deny for license, duplicate and source checks - #47
Merged
Conversation
Adds a `cargo deny check licenses bans sources` job alongside the existing cargo audit job. The `advisories` check is deliberately left out — cargo audit already covers RustSec, and running both duplicates the signal without adding coverage. What the three enabled checks buy: - licenses: dependency licenses must be compatible with GPL-3.0-only. Current tree is permissive plus MPL-2.0 (colored) and Unicode-3.0 (unicode-ident), both GPL-compatible. - bans: no crate may appear at two versions. This is the guard against a second RustCrypto trait generation entering the graph, the failure mode .github/dependabot.yml already groups crates to avoid. syn is skipped: 2.x and 3.x coexist via zeroize_derive vs clap_derive and are proc-macro build-time only. - sources: every dependency must resolve to crates.io, failing on git or alternate-registry sources. Verified against the current tree: all three pass clean. Also verified they actually bite — removing MPL-2.0 from the allow list or the syn skip makes the run exit non-zero. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a
cargo deny check licenses bans sourcesjob alongside the existingcargo auditjob, plus adeny.tomlpolicy file.The
advisoriescheck is deliberately not run —cargo auditalready covers RustSec and reports informational (unsound / unmaintained) findings as warnings. Running both would duplicate the signal.What the three enabled checks buy
licensescolored) and Unicode-3.0 (unicode-ident), both GPL-compatible.bans.github/dependabot.ymlalready groups crates to avoid.sourcessynis the one skip: 2.x and 3.x coexist viazeroize_derivevsclap_derive/thiserror-impl, and both are proc-macro build-time only — they never reach the shipped binary.Verification
cargo deny check licenses bans sources→bans ok, licenses ok, sources ok, no warningsMPL-2.0from the allow list, or thesynskip, makes the run exit non-zero (exit 4) rather than passing vacuouslycargo fmt --check,cargo clippy --all-targets -- -D warnings, and all 138 tests pass locallyNo Rust code changed, so no new tests are needed; the CONTRIBUTING.md test count (138) is unchanged and still accurate.
🤖 Generated with Claude Code