Skip to content

ci: add cargo-deny for dependency auditing#39

Open
Pama-Lee wants to merge 4 commits intomainfrom
feat/cargo-deny
Open

ci: add cargo-deny for dependency auditing#39
Pama-Lee wants to merge 4 commits intomainfrom
feat/cargo-deny

Conversation

@Pama-Lee
Copy link
Copy Markdown
Collaborator

@Pama-Lee Pama-Lee commented Mar 9, 2026

Summary

  • Add deny.toml with license allowlist (MIT, Apache-2.0, BSD, ISC, etc.), deny copyleft (GPL/LGPL/AGPL)
  • Enable advisory checks: deny known vulnerabilities, warn on unmaintained/yanked crates
  • Ban wildcard dependencies, warn on duplicate crate versions
  • Restrict crate sources to crates.io only
  • Add deny job to CI workflow using EmbarkStudios/cargo-deny-action@v2

Test plan

  • CI deny job passes on this PR
  • No false positives blocking legitimate dependencies

Add deny.toml with license allowlist (MIT/Apache/BSD/etc), advisory checks,
ban wildcards, and source restrictions. Add deny job to CI workflow.
@vercel
Copy link
Copy Markdown

vercel Bot commented Mar 9, 2026

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
ordo_docs Ready Ready Preview, Comment Mar 17, 2026 1:22am

Remove `vulnerability`, `notice` (advisories) and `deny` (licenses)
keys that were removed in cargo-deny PR #611.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants