Skip to content

feat: add cargo-deny for supply chain safety #834

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
zmanian merged 12 commits into from
Mar 12, 2026
Merged

feat: add cargo-deny for supply chain safety #834

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
2a05dd2
feat: add cargo-deny for supply chain safety
ilblackdragon Mar 10, 2026
ed5f110
fix: use cargo-deny action in CI, improve quality gate script
ilblackdragon Mar 10, 2026
34643fc
fix: add missing Unlicense and CDLA-Permissive-2.0 to license allowlist
ilblackdragon Mar 10, 2026
ad81f25
chore: trigger CI after retargeting PR to staging
ilblackdragon Mar 10, 2026
6fc8218
fix: use valid cargo-deny v0.19 syntax for unmaintained advisories
ilblackdragon Mar 10, 2026
476372b
chore: re-trigger CI after adding skip-regression-check label
ilblackdragon Mar 10, 2026
6b3fcab
fix: migrate deny.toml [licenses] to version 2 format
ilblackdragon Mar 10, 2026
c7f6fbc
fix: ignore pre-existing advisories in deny.toml with justification
ilblackdragon Mar 10, 2026
bbb5321
fix: address PR review feedback for cargo-deny integration
ilblackdragon Mar 10, 2026
ce4dec7
fix(deny.toml): correct serde_yml advisory comment to reflect direct …
ilblackdragon Mar 10, 2026
9aefa98
fix: tighten clippy-windows check in roll-up job
ilblackdragon Mar 11, 2026
ee849d3
fix: cd to repo root in strict gate, deny wildcard versions
ilblackdragon Mar 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 15 additions & 6 deletions .github/workflows/code_style.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,15 @@ jobs:
- name: Check formatting
run: cargo fmt --all -- --check

deny-check:
name: cargo-deny
runs-on: ubuntu-latest
steps:
- name: Checkout repository
uses: actions/checkout@v6
- name: Run cargo deny
uses: EmbarkStudios/cargo-deny-action@v2
Comment on lines +22 to +26

Copilot AI Mar 10, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In the new deny-check job, the steps: list items are not indented under steps (they’re aligned at the same level), which makes the workflow YAML invalid and will prevent GitHub Actions from parsing the file. Also consider adding the same Rust toolchain installation step used by the other jobs (dtolnay/rust-toolchain@stable) so cargo is guaranteed to be available when running the cargo-deny action.

Copilot uses AI. Check for mistakes.

@ilblackdragon ilblackdragon Mar 10, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Verified — YAML is valid and already uses the GitHub Action, not cargo install.


clippy:
Comment on lines +25 to 28

Copilot AI Mar 10, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

cargo install cargo-deny installs an unpinned version on every run, which can introduce non-determinism (new deny behavior) and adds significant CI time. Consider pinning a version (and using --locked) or using a dedicated installer action with caching so the job is reproducible and faster.

Copilot uses AI. Check for mistakes.

@ilblackdragon ilblackdragon Mar 10, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Already uses EmbarkStudios/cargo-deny-action@v2, not cargo install. No change needed.

name: Clippy (${{ matrix.name }})
runs-on: ubuntu-latest
Expand Down Expand Up @@ -71,18 +80,18 @@ jobs:

# Roll-up job for branch protection
code-style:
name: Code Style (fmt + clippy)
name: Code Style (fmt + clippy + deny)
runs-on: ubuntu-latest
if: always()
needs: [format, clippy, clippy-windows]
needs: [format, clippy, clippy-windows, deny-check]
steps:
- run: |
if [[ "${{ needs.format.result }}" != "success" || "${{ needs.clippy.result }}" != "success" ]]; then
if [[ "${{ needs.format.result }}" != "success" || "${{ needs.clippy.result }}" != "success" || "${{ needs.deny-check.result }}" != "success" ]]; then
echo "One or more jobs failed"
exit 1
fi
# clippy-windows only runs on main PRs, so skip/success are both acceptable
if [[ "${{ needs.clippy-windows.result }}" == "failure" ]]; then
echo "Windows clippy failed"
# clippy-windows only runs on main PRs, so skipped is acceptable but failure is not
if [[ "${{ needs.clippy-windows.result }}" != "success" && "${{ needs.clippy-windows.result }}" != "skipped" ]]; then
echo "Windows clippy failed: ${{ needs.clippy-windows.result }}"
exit 1
fi
50 changes: 50 additions & 0 deletions deny.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,50 @@
[advisories]
unmaintained = "workspace"
yanked = "deny"
ignore = [
# Pre-existing advisories — tracked for upgrade in separate PRs
# serde_yml unsound/unmaintained — direct dep, upgrade tracked separately
"RUSTSEC-2025-0068",
# tokio-tar PAX header parsing — sandbox containers only
"RUSTSEC-2025-0111",
# wasmtime fd_renumber host panic — WASIp1, mitigated by fuel limits
"RUSTSEC-2025-0046",
# wasmtime shared linear memory unsoundness — no shared memory in our guests
"RUSTSEC-2025-0118",
# wasmtime guest-controlled resource exhaustion — mitigated by fuel/memory limits
"RUSTSEC-2026-0020",
# wasmtime wasi:http/types.fields panic — mitigated by fuel limits
"RUSTSEC-2026-0021",
]

[licenses]
version = 2
allow = [
"MIT",
"Apache-2.0",
"Apache-2.0 WITH LLVM-exception",
"BSD-2-Clause",
"BSD-3-Clause",
"ISC",
"Unicode-3.0",
"Unicode-DFS-2016",
"OpenSSL",
"Zlib",
"MPL-2.0",
"0BSD",
"BSL-1.0",
"CC0-1.0",
"Unlicense",
"CDLA-Permissive-2.0",
]
unused-allowed-license = "allow"

[bans]
multiple-versions = "warn"
wildcards = "deny"

[sources]
unknown-registry = "deny"
unknown-git = "deny"
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
allow-git = []
21 changes: 21 additions & 0 deletions scripts/ci/quality_gate_strict.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,21 @@
#!/usr/bin/env bash
set -euo pipefail

Copilot AI Mar 11, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Most repo scripts cd to the repository root early (e.g. via git rev-parse --show-toplevel or cd "$(dirname "$0")/.."). This script assumes it is invoked from the repo root; running it from another working directory (common in CI or when called by other scripts) will make cargo operate on the wrong manifest or fail to find deny.toml. Consider adding an explicit cd to the repo root near the top (right after set -euo pipefail).

Suggested change
# Ensure we are running from the repository root
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
cd "${SCRIPT_DIR}/../.."

Copilot uses AI. Check for mistakes.

@ilblackdragon ilblackdragon Mar 12, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed in ee849d3 — added cd "$(git rev-parse --show-toplevel)" at the top of the script.

# Ensure we are running from the repository root
cd "$(git rev-parse --show-toplevel)"

echo "==> fmt check"
cargo fmt --all -- --check

echo "==> clippy (all warnings)"
cargo clippy --locked --all --benches --tests --examples --all-features -- -D warnings

echo "==> cargo deny"
if ! command -v cargo-deny &>/dev/null; then
echo "ERROR: cargo-deny not installed (install with: cargo install cargo-deny)"
exit 1
fi
Comment on lines +13 to +17

Copilot AI Mar 10, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This script is labeled quality_gate_strict, but it silently skips the cargo-deny checks when cargo-deny isn’t installed (only printing a warning). That can allow local/CI “strict” runs to pass without supply-chain checks. Consider failing with a clear install instruction, or gating the skip behind an explicit opt-out env var (e.g. ALLOW_MISSING_CARGO_DENY=1).

Copilot uses AI. Check for mistakes.

@ilblackdragon ilblackdragon Mar 10, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed in bbb5321 — strict mode now fails when cargo-deny is not installed.

cargo deny check

echo "==> tests"
cargo test --locked
Loading