ci: add cargo-deny (advisories, licenses, bans, sources)

.github/workflows/ci.yml

@@ -112,6 +112,15 @@ jobs:
         run: test "$(uname -m)" = "${{ matrix.arch }}"
       - run: cargo test --workspace --all-targets
 
+  cargo-deny:
+    name: cargo-deny
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: EmbarkStudios/cargo-deny-action@v2
+        with:
+          command: check
+
   clippy-windows:
     name: clippy (windows)
     runs-on: windows-latest

deny.toml

@@ -0,0 +1,37 @@
+# cargo-deny configuration — advisories, licenses, and source hygiene for the
+# whole dependency graph (including the git-pinned gpui/zed tree).
+# Run locally with: nix run nixpkgs#cargo-deny -- check
+
+[advisories]
+yanked = "deny"
+
+[licenses]
+# Additions here need a conscious decision; keep the list to what the graph
+# actually pulls in.
+allow = [
+    "0BSD",
+    "CDLA-Permissive-2.0",
+    "MIT",
+    "Apache-2.0",
+    "Apache-2.0 WITH LLVM-exception",
+    "BSD-2-Clause",
+    "BSD-3-Clause",
+    "ISC",
+    "Zlib",
+    "Unicode-3.0",
+    "MPL-2.0",
+    "CC0-1.0",
+]
+
+[bans]
+# The zed/gpui tree inevitably carries duplicate versions; keep this advisory
+# rather than blocking.
+multiple-versions = "warn"
+
+[sources]
+unknown-registry = "deny"
+unknown-git = "deny"
+allow-git = [
+    "https://github.com/zed-industries/zed",
+    "https://github.com/longbridge/gpui-component",
+]

devenv.lock

@@ -67,11 +67,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1779592685,
-        "narHash": "sha256-p9d56GezhHRf4QfANxwa1d+fvwShvjB5XUhdIl7WEd0=",
+        "lastModified": 1783144302,
+        "narHash": "sha256-NQnzmXwpEAd5tjMBh2+P/y9NknF+WHv5+6yoXoN4h/Y=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "3a58b199e7c83a80b85c28044f808085ba7e941c",
+        "rev": "fe5aee0952e8e1525533d61defd9e36513db811b",
         "type": "github"
       },
       "original": {