molluskandClaude Opus 4.8
e4767be210
Adds a Gitea Actions workflow that runs `cargo deny --locked check` on every push to main and every PR, so the deny.toml policy (advisories, bans, licenses, sources) is enforced automatically rather than by hand. Runs on a locked tree so the pinned versions in Cargo.lock are what get audited; a poisoned dependency release can't reach CI until Cargo.lock is deliberately updated. cargo-deny is pinned to 0.19.9 via a prebuilt binary. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
35 lines
1.2 KiB
YAML
35 lines
1.2 KiB
YAML
name: cargo-deny
|
|
|
|
# Enforce the supply-chain policy in deny.toml (advisories / bans / licenses /
|
|
# sources) on every push to main and every PR. Runs on a *locked* tree so the
|
|
# pinned, vetted versions in Cargo.lock are exactly what get audited — see the
|
|
# deny.toml header and VERSIONING.md. A new poisoned release of a dependency
|
|
# cannot reach CI until Cargo.lock is deliberately updated.
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
|
|
jobs:
|
|
cargo-deny:
|
|
runs-on: ubuntu-latest
|
|
# rust:1 provides the cargo toolchain that cargo-deny shells out to for
|
|
# `cargo metadata`. Adjust the runner label if your act_runner uses a
|
|
# different one.
|
|
container: rust:1
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Install cargo-deny (pinned prebuilt)
|
|
run: |
|
|
set -euo pipefail
|
|
version=0.19.9
|
|
curl -sSfL \
|
|
"https://github.com/EmbarkStudios/cargo-deny/releases/download/${version}/cargo-deny-${version}-x86_64-unknown-linux-musl.tar.gz" \
|
|
| tar -xz -C /usr/local/bin --strip-components=1 --wildcards '*/cargo-deny'
|
|
cargo-deny --version
|
|
|
|
- name: cargo deny check
|
|
run: cargo deny --locked check
|