License & Security Audit (cargo-deny) #92
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: License & Security Audit (cargo-deny) | |
| # Runs on every PR and on pushes to main/multinode. | |
| # Blocks on: forbidden licenses, known CVEs, unsound crates, wildcard deps. | |
| # Warns on: unmaintained crates, duplicate versions. | |
| # | |
| # See deny.toml for the full policy (Phase 1.10). | |
| # Docs: https://embarkstudios.github.io/cargo-deny/ | |
| on: | |
| push: | |
| branches: [ "main" ] | |
| paths: | |
| - "Cargo.toml" | |
| - "Cargo.lock" | |
| - "**/Cargo.toml" | |
| - "deny.toml" | |
| - ".github/workflows/cargo-deny.yml" | |
| pull_request: | |
| branches: [ "main" ] | |
| paths: | |
| - "Cargo.toml" | |
| - "Cargo.lock" | |
| - "**/Cargo.toml" | |
| - "deny.toml" | |
| schedule: | |
| # Run daily at 06:00 UTC to catch newly published advisories. | |
| - cron: "0 6 * * *" | |
| workflow_dispatch: | |
| jobs: | |
| deny: | |
| name: cargo-deny check | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Run cargo-deny | |
| uses: EmbarkStudios/cargo-deny-action@v2 | |
| with: | |
| # deny.toml lives at the repo root. | |
| manifest-path: Cargo.toml | |
| # Run all checks: licenses, advisories, bans, sources. | |
| command: check | |
| # Note: all-features is configured in deny.toml ([graph]); we do not | |
| # pass it on the CLI because cargo-deny 0.14+ rejects `--all-features` | |
| # after the `check` subcommand. | |
| arguments: "" |