Forbid unsafe code in the HASH graph (#1064)

Co-authored-by: Alfred Mountfield <am@hash.ai>

packages/graph/hash_graph/Makefile.toml

@@ -11,10 +11,15 @@ CARGO_MAKE_CARGO_PROFILE = "production"
 
 [tasks.test]
 run_task = [
-    { name = ["test-task", "yarn", "deployment-up", "test-integration", "generate-openapi-client", "deployment-down"], condition = { env_true = ["CARGO_MAKE_CI" ] } },
+    { name = ["test-task", "yarn", "deployment-up", "test-integration", "generate-openapi-client", "deployment-down"], condition = { env_true = ["CARGO_MAKE_CI"] } },
     { name = ["test-task"] }
 ]
 
+[tasks.miri]
+clear = true
+command = "echo"
+args = ["Miri is disabled as unsafe code is forbidden"]
+
 [tasks.test-integration]
 private = false
 extend = "task"

packages/graph/hash_graph/bin/hash_graph/src/main.rs

@@ -1,3 +1,5 @@
+#![forbid(unsafe_code)]
+
 mod args;
 
 use std::{collections::HashMap, fmt, net::SocketAddr, sync::Arc};

packages/graph/hash_graph/lib/graph/src/lib.rs

@@ -46,6 +46,16 @@
     clippy::use_debug,
     clippy::verbose_file_reads
 )]
+// Until we do optimization work, there is unlikely to be any reason to use unsafe code. When it
+// becomes necessary/desirable to allow for unsafe code, we should:
+// - enable miri checks in the CI for the relevant code
+// - swap this lint with `#![deny(unsafe_code)]` and only allow it in a few places unless, or until,
+//   it gets very verbose to do so.
+#![forbid(
+    unsafe_code,
+    reason = "Unsafe code has been disabled until a good argument has been put forward for its \
+              usage"
+)]
 #![allow(
     clippy::module_name_repetitions,
     reason = "This encourages importing `as` which breaks IDEs"