Skip to content

Commit d49566e

Browse files
jpschorrjpschorr
authored
Add cargo-deny config and CI action to enforce it (#281)
1 parent 5928084 commit d49566e

File tree

2 files changed

+177
-0
lines changed

2 files changed

+177
-0
lines changed

‎.github/workflows/ci_build_test.yml

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -73,6 +73,30 @@ jobs:
7373
with:
7474
path: ./*
7575
key: ${{ github.sha }}
76+
77+
# Run cargo-deny check and report.
78+
# Fails if any of the following are found used in the crate or its dependencies.
79+
# - any banned crates
80+
# - disallowed open source licenses
81+
# - use of disallowed repository sources
82+
# Reports, but does not fail on:
83+
# - security advisories
84+
# See: https://embarkstudios.github.io/cargo-deny/index.html
85+
cargo-deny:
86+
runs-on: ubuntu-latest
87+
strategy:
88+
matrix:
89+
checks:
90+
- advisories
91+
- bans licenses sources
92+
# Prevent sudden announcement of a new advisory from failing ci:
93+
continue-on-error: ${{ matrix.checks == 'advisories' }}
94+
steps:
95+
- uses: actions/checkout@v3
96+
- uses: EmbarkStudios/cargo-deny-action@v1
97+
with:
98+
command: check ${{ matrix.checks }}
99+
76100
# Conformance report generation and comparison report generation job will run only after the `Build and Test` job
77101
# succeeds.
78102
conformance-report:

‎deny.toml

Lines changed: 153 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,153 @@
1+
2+
# This section is considered when running `cargo deny check advisories`
3+
# More documentation for the advisories section can be found here:
4+
# https://embarkstudios.github.io/cargo-deny/checks/advisories/cfg.html
5+
[advisories]
6+
vulnerability = "deny"
7+
unsound = "deny"
8+
unmaintained = "deny"
9+
yanked = "deny"
10+
notice = "warn"
11+
12+
ignore = [
13+
# Advisory: https://rustsec.org/advisories/RUSTSEC-2021-0145
14+
# atty potential misaligned pointer; used by some pretty-printing deps (criterion, miette, lalrpop)
15+
"RUSTSEC-2021-0145",
16+
17+
# Advisory: https://rustsec.org/advisories/RUSTSEC-2020-0071
18+
# `chrono` uses an old version of `time`, but `chrono` >= 4.2 doesn't use the code path with the issue
19+
"RUSTSEC-2020-0071",
20+
]
21+
22+
23+
24+
25+
# This section is considered when running `cargo deny check licenses`
26+
# More documentation for the licenses section can be found here:
27+
# https://embarkstudios.github.io/cargo-deny/checks/licenses/cfg.html
28+
[licenses]
29+
# The lint level for crates which do not have a detectable license
30+
unlicensed = "deny"
31+
# ignores workspace crates that aren't published, or are only published to private registries.
32+
private = { ignore = true }
33+
34+
# List of explicitly allowed licenses
35+
# See https://spdx.org/licenses/ for list of possible licenses
36+
# [possible values: any SPDX 3.11 short identifier (+ optional exception)].
37+
#
38+
# This list must be manually reconciled with the `accepted` in `about.toml`
39+
# If you change this list, please also change `about.toml`
40+
# see https://github.com/EmbarkStudios/cargo-about/issues/201
41+
allow = [
42+
"MIT",
43+
"Apache-2.0",
44+
"0BSD",
45+
"BSD-2-Clause",
46+
"BSD-3-Clause",
47+
"CC0-1.0",
48+
"ISC",
49+
"Zlib",
50+
"ICU",
51+
]
52+
53+
# Allow 1 or more licenses on a per-crate basis, so that particular licenses
54+
# aren't accepted for every possible crate as with the normal allow list
55+
#
56+
# This list must be manually reconciled with the `accepted` in `about.toml`
57+
# If you change this list, please also change `about.toml`
58+
# see https://github.com/EmbarkStudios/cargo-about/issues/201
59+
exceptions = [
60+
{ allow = ["Unicode-DFS-2016"], name = "unicode-ident" },
61+
]
62+
63+
# Lint level for licenses considered copyleft
64+
copyleft = "deny"
65+
66+
# List of explicitly disallowed licenses
67+
# See https://spdx.org/licenses/ for list of possible licenses
68+
# [possible values: any SPDX 3.11 short identifier (+ optional exception)].
69+
deny = [
70+
]
71+
72+
# Blanket approval or denial for OSI-approved or FSF Free/Libre licenses
73+
# * both - The license will be approved if it is both OSI-approved *AND* FSF
74+
# * either - The license will be approved if it is either OSI-approved *OR* FSF
75+
# * osi-only - The license will be approved if is OSI-approved *AND NOT* FSF
76+
# * fsf-only - The license will be approved if is FSF *AND NOT* OSI-approved
77+
# * neither - This predicate is ignored and the default lint level is used
78+
allow-osi-fsf-free = "neither"
79+
80+
# Lint level used when no other predicates are matched
81+
# 1. License isn't in the allow or deny lists
82+
# 2. License isn't copyleft
83+
# 3. License isn't OSI/FSF, or allow-osi-fsf-free = "neither"
84+
default = "deny"
85+
86+
# The confidence threshold for detecting a license from license text.
87+
# The higher the value, the more closely the license text must be to the
88+
# canonical license text of a valid SPDX license file.
89+
# [possible values: any between 0.0 and 1.0].
90+
confidence-threshold = 0.93
91+
92+
93+
94+
95+
96+
# This section is considered when running `cargo deny check bans`.
97+
# More documentation about the 'bans' section can be found here:
98+
# https://embarkstudios.github.io/cargo-deny/checks/bans/cfg.html
99+
[bans]
100+
# Lint level for when multiple versions of the same crate are detected
101+
multiple-versions = "warn"
102+
# Lint level for when a crate version requirement is `*`
103+
wildcards = "warn"
104+
# The graph highlighting used when creating dotgraphs for crates
105+
# with multiple versions
106+
# * lowest-version - The path to the lowest versioned duplicate is highlighted
107+
# * simplest-path - The path to the version with the fewest edges is highlighted
108+
# * all - Both lowest-version and simplest-path are used
109+
highlight = "all"
110+
# The default lint level for `default` features for crates that are members of
111+
# the workspace that is being checked. This can be overriden by allowing/denying
112+
# `default` on a crate-by-crate basis if desired.
113+
workspace-default-features = "allow"
114+
# The default lint level for `default` features for external crates that are not
115+
# members of the workspace. This can be overriden by allowing/denying `default`
116+
# on a crate-by-crate basis if desired.
117+
external-default-features = "allow"
118+
# List of crates that are allowed. Use with care!
119+
allow = [
120+
#{ name = "ansi_term", version = "=0.11.0" },
121+
]
122+
# List of crates to deny
123+
deny = [
124+
# Use `once_cell` instead
125+
# `OnceCell`s API is under consideration for inclusion in `std`: https://github.com/rust-lang/rust/issues/74465
126+
{ name = "lazy_static", wrappers = ["Inflector", "criterion"]},
127+
128+
129+
# Advisory: https://rustsec.org/advisories/RUSTSEC-2020-0071
130+
# `time` < 0.2.23 has a potential (though unlikely) potential segfault
131+
{ name = "time", version ="<0.2.23", wrappers = ["chrono"]},
132+
# Advisory: https://rustsec.org/advisories/RUSTSEC-2020-0071
133+
# `chrono` uses an old version of `time`, but `chrono` >= 4.2 doesn't use the code path with the issue
134+
{ name = "chrono", version ="<0.4.20"}
135+
]
136+
137+
138+
# This section is considered when running `cargo deny check sources`.
139+
# More documentation about the 'sources' section can be found here:
140+
# https://embarkstudios.github.io/cargo-deny/checks/sources/cfg.html
141+
[sources]
142+
# Lint level for what to happen when a crate from a crate registry that is not
143+
# in the allow list is encountered
144+
unknown-registry = "deny"
145+
# Lint level for what to happen when a crate from a git repository that is not
146+
# in the allow list is encountered
147+
unknown-git = "deny"
148+
# List of URLs for allowed crate registries. Defaults to the crates.io index
149+
# if not specified. If it is specified but empty, no registries are allowed.
150+
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
151+
# List of URLs for allowed Git repositories
152+
allow-git = []
153+

0 commit comments

Comments
 (0)