chore: add cargo-deny configuration #7119
Conversation
joshka-oai
commented
Nov 21, 2025
joshka-oai
commented
- add GitHub workflow running cargo-deny on push/PR
- document cargo-deny allowlist with workspace-dep notes and advisory ignores
- align workspace crates to inherit version/edition/license for consistent checks
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
joshka-oai
force-pushed
the
joshka/cargo-deny
branch
from
1108fe5 to
325c6d8
Compare
joshka-oai
left a comment
joshka-oai
left a comment
There was a problem hiding this comment.
Self review notes
| @@ -1,7 +1,8 @@ | |||
| [package] | |||
| name = "codex-backend-client" | |||
| version = "0.0.0" | |||
There was a problem hiding this comment.
I'm assuming that this is fine to bump - we're not publishing this, so it doesn't really matter what it's set to here
There was a problem hiding this comment.
2024 edition formatting changes
There was a problem hiding this comment.
2024 edition formatting changes
| @@ -1,7 +1,8 @@ | |||
| [package] | |||
| name = "codex-windows-sandbox" | |||
| version = "0.1.0" | |||
There was a problem hiding this comment.
I assume this version is not really relevant - please confirm @iceweasel-oai
| ignore = [ | ||
| { id = "RUSTSEC-2024-0388", reason = "derivative is unmaintained; pulled in via starlark v0.13.0 used by execpolicy/cli/core; no fixed release yet" }, | ||
| { id = "RUSTSEC-2025-0057", reason = "fxhash is unmaintained; pulled in via starlark_map/starlark v0.13.0 used by execpolicy/cli/core; no fixed release yet" }, | ||
| { id = "RUSTSEC-2024-0436", reason = "paste is unmaintained; pulled in via ratatui/rmcp/starlark used by tui/execpolicy; no fixed release yet" }, |
| # List of explicitly allowed licenses | ||
| # See https://spdx.org/licenses/ for list of possible licenses | ||
| # [possible values: any SPDX 3.11 short identifier (+ optional exception)]. | ||
| allow = [ |
There was a problem hiding this comment.
Added based on the current list of licenses. I also made codex fill in the comments here, mostly to help validate why we'e got each of these in our allow list - these will likely get out of date easily, this is not a big deal IMO)
| # https://embarkstudios.github.io/cargo-deny/checks/bans/cfg.html | ||
| [bans] | ||
| # Lint level for when multiple versions of the same crate are detected | ||
| multiple-versions = "warn" |
There was a problem hiding this comment.
This triggers a bunch. We may consider allow here if that's annoying. Fixing the problems here is out of scope for this change.
| github = [ | ||
| "nornagon", # ratatui and crossterm forks | ||
| ] |
There was a problem hiding this comment.
Mostly default - called out the actual changes (I also intentionally committed the default so that the changes are visible).
joshka-oai
force-pushed
the
joshka/cargo-deny
branch
5 times, most recently
from
c6f934c to
8b0559e
Compare
- add GitHub workflow running cargo-deny on push/PR - document cargo-deny allowlist with workspace-dep notes and advisory ignores - align workspace crates to inherit version/edition/license for consistent checks
joshka-oai
force-pushed
the
joshka/cargo-deny
branch
from
8b0559e to
c4e8da4
Compare
joshka-oai
left a comment
joshka-oai
left a comment
There was a problem hiding this comment.
undid a couple of edition (pty and windows-sandbox) as CI shows that changing the edition changes the behavior on these items.
| @@ -1,16 +1,13 @@ | |||
| [package] | |||
| edition = "2021" | |||
There was a problem hiding this comment.
Intentionally kept as 2021. This affects how the code in this runs
| [package] | ||
| name = "codex-windows-sandbox" | ||
| version = "0.1.0" | ||
| edition = "2021" |
There was a problem hiding this comment.
Intentionally kept as 2021. This affects how the code in this runs
