[rust] Verify the release metadata in CI (apache#4169)

Author: fresh-borzoni

.github/workflows/gateway-ci.yml

@@ -134,7 +134,7 @@ jobs:
       - name: Install cargo-deny
         uses: taiki-e/install-action@v2
         with:
-          tool: cargo-deny@0.14.22
+          tool: cargo-deny@0.20.2
 
       - name: Check dependency licenses (Apache-compatible)
         run: cargo deny --locked check licenses

.github/workflows/rust-license-and-format.yml

@@ -26,6 +26,10 @@ on:
       - 'fluss-rust/bindings/**'
       - 'fluss-rust/Cargo.toml'
       - 'fluss-rust/Cargo.lock'
+      - 'fluss-rust/DEPENDENCIES.rust.tsv'
+      - 'fluss-rust/LICENSE'
+      - 'fluss-rust/NOTICE'
+      - 'fluss-rust/scripts/**'
       - 'fluss-rust/deny.toml'
       - 'fluss-rust/.licenserc.yaml'
       - 'fluss-rust/rustfmt.toml'
@@ -40,6 +44,10 @@ on:
       - 'fluss-rust/bindings/**'
       - 'fluss-rust/Cargo.toml'
       - 'fluss-rust/Cargo.lock'
+      - 'fluss-rust/DEPENDENCIES.rust.tsv'
+      - 'fluss-rust/LICENSE'
+      - 'fluss-rust/NOTICE'
+      - 'fluss-rust/scripts/**'
       - 'fluss-rust/deny.toml'
       - 'fluss-rust/.licenserc.yaml'
       - 'fluss-rust/rustfmt.toml'
@@ -70,11 +78,29 @@ jobs:
       - name: Install cargo-deny
         uses: taiki-e/install-action@v2
         with:
-          tool: cargo-deny@0.14.22
+          tool: cargo-deny@0.20.2
 
       - name: Check dependency licenses (Apache-compatible)
         run: cargo deny check licenses
 
+      # The inventory ships with the source release, so a stale one is worse than none.
+      - name: Dependency inventory drift check
+        run: |
+          cargo fetch --locked
+          python3 scripts/dependencies.py verify
+
+      # release.sh archives this subtree and nothing else inspects the result;
+      # the crate is covered by rust-release.yml before it publishes.
+      - name: Source release contents
+        run: |
+          git archive --prefix=t/ HEAD | tar -t > "${RUNNER_TEMP}/tarball.txt"
+          for f in LICENSE NOTICE DEPENDENCIES.rust.tsv; do
+            grep -qxF "t/$f" "${RUNNER_TEMP}/tarball.txt" || {
+              echo "::error::source release is missing $f"
+              exit 1
+            }
+          done
+
       - name: Rust Cache
         uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
         with:

.github/workflows/rust-release.yml

@@ -44,10 +44,10 @@ jobs:
 
       # cargo packs only the crate directory, so the LICENSE/NOTICE above it
       # never reach the .crate.
-      - name: Verify LICENSE and NOTICE in the crate
+      - name: Verify LICENSE, NOTICE and the dependency inventory in the crate
         run: |
           FILES=$(cargo package --list --allow-dirty -p fluss-rs)
-          for f in LICENSE NOTICE; do
+          for f in LICENSE NOTICE DEPENDENCIES.rust.tsv; do
             if ! echo "$FILES" | grep -qx "$f"; then
               echo "Error: ${f} is missing from the fluss-rs crate"
               exit 1