From e4767be210c413556bf5103edceff7a965fec6ef Mon Sep 17 00:00:00 2001 From: Mollusk Date: Thu, 18 Jun 2026 16:00:36 -0400 Subject: [PATCH] ci: enforce cargo-deny supply-chain policy on push and PRs Adds a Gitea Actions workflow that runs `cargo deny --locked check` on every push to main and every PR, so the deny.toml policy (advisories, bans, licenses, sources) is enforced automatically rather than by hand. Runs on a locked tree so the pinned versions in Cargo.lock are what get audited; a poisoned dependency release can't reach CI until Cargo.lock is deliberately updated. cargo-deny is pinned to 0.19.9 via a prebuilt binary. Co-Authored-By: Claude Opus 4.8 --- .gitea/workflows/cargo-deny.yml | 34 +++++++++++++++++++++++++++++++++ 1 file changed, 34 insertions(+) create mode 100644 .gitea/workflows/cargo-deny.yml diff --git a/.gitea/workflows/cargo-deny.yml b/.gitea/workflows/cargo-deny.yml new file mode 100644 index 0000000..bfefc94 --- /dev/null +++ b/.gitea/workflows/cargo-deny.yml @@ -0,0 +1,34 @@ +name: cargo-deny + +# Enforce the supply-chain policy in deny.toml (advisories / bans / licenses / +# sources) on every push to main and every PR. Runs on a *locked* tree so the +# pinned, vetted versions in Cargo.lock are exactly what get audited — see the +# deny.toml header and VERSIONING.md. A new poisoned release of a dependency +# cannot reach CI until Cargo.lock is deliberately updated. + +on: + push: + branches: [main] + pull_request: + +jobs: + cargo-deny: + runs-on: ubuntu-latest + # rust:1 provides the cargo toolchain that cargo-deny shells out to for + # `cargo metadata`. Adjust the runner label if your act_runner uses a + # different one. + container: rust:1 + steps: + - uses: actions/checkout@v4 + + - name: Install cargo-deny (pinned prebuilt) + run: | + set -euo pipefail + version=0.19.9 + curl -sSfL \ + "https://github.com/EmbarkStudios/cargo-deny/releases/download/${version}/cargo-deny-${version}-x86_64-unknown-linux-musl.tar.gz" \ + | tar -xz -C /usr/local/bin --strip-components=1 --wildcards '*/cargo-deny' + cargo-deny --version + + - name: cargo deny check + run: cargo deny --locked check