ci: add cargo-deny job (LAN-231)#147
Merged
Merged
Conversation
cargo-deny 0.19.8 checking licenses, bans, and sources on every PR: permissive-only license allow-list with a scoped MPL-2.0 exception for option-ext (via dirs); duplicate versions warn rather than fail; unknown registries/git sources denied. Policy lives in deny.toml. Advisories are deliberately excluded — audit.yml owns cargo-audit and two advisory gates would double the noise. Typos and the Windows check, also on the LAN-231 list, already landed (7d7b7b4, 768beec); ROADMAP now reflects all three as done. Remaining: the nightly ThreadSanitizer/loom concurrency pass.
lance0
force-pushed
the
ci/lan-231-batch2
branch
from
July 24, 2026 14:30
3ce7b09 to
c53ff9d
Compare
lance0
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds the cargo-deny check from LAN-231. (The other two quick items on that list — typos and the Windows
cargo check— turned out to already be on master via 7d7b7b4 / 768beec; an earlier revision of this PR duplicated them, which GitHub rejected as a workflow parse error. Now this PR is cargo-deny only, plus ROADMAP bookkeeping for all three.)What it checks (
cargo deny check licenses bans sources, pinned 0.19.8)deny.toml, with one scoped exception —option-ext(MPL-2.0, pulled bydirs). A new copyleft dependency fails the PR instead of slipping in via the lockfile.audit.ymlowns cargo-audit; two advisory gates would double the noise.Validated locally:
cargo deny check licenses bans sources→bans ok, licenses ok, sources ok, and the workflow passes actionlint. The job self-validates on this PR.Remaining from LAN-231: the nightly ThreadSanitizer/loom concurrency pass.