Skip to content

ci(security): run cargo deny for licenses and duplicate dependencies - #195

Closed
dezzy-music wants to merge 1 commit into
DepRadarOrg:mainfrom
dezzy-music:security/163-cargo-deny
Closed

dezzy-music wants to merge 1 commit into
DepRadarOrg:mainfrom
dezzy-music:security/163-cargo-deny

Conversation

@dezzy-music

Copy link
Copy Markdown

Description

Adds deny.toml configuration for cargo-deny to check and enforce licensing policies (allowing MIT, Apache-2.0, BSD variants, ISC, Unicode, Unlicense, Zlib, BSL-1.0, CDLA-Permissive-2.0, CC0-1.0) and restrict dependencies to trusted crates.io registries. Integrates cargo deny check into the Dependency Audit workflow using EmbarkStudios/cargo-deny-action@v2.

Closes #163


Tasks Completed

  • Created deny.toml with allowed licenses, ban rules, and registry sources.
  • Configured deny.toml in .github/workflows/audit.yml paths to trigger PR audits when updated.
  • Added cargo-deny job executing cargo deny check via EmbarkStudios/cargo-deny-action@v2.
  • Documented the change in PROGRESS.md.

Acceptance Criteria

  • deny.toml created allowing MIT, Apache-2.0, BSD, ISC, Unicode, etc.
  • Dependency audit workflow updated with cargo deny check
  • PROGRESS.md entry added, and the PR description includes Closes #163

Stellar Address (Stellar Wave Program)

GDLCJGQLXZGDAAT5QGRF6FM2MBEER3FPYGCSVPXYL47G2ABIOX2M2S6K

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[security] Run cargo deny for licenses and duplicate dependencies

2 participants