Skip to content

Run cargo deny on CI#8480

Closed
Copilot wants to merge 2 commits intounstablefrom
copilot/add-cargo-deny-ci
Closed

Run cargo deny on CI#8480
Copilot wants to merge 2 commits intounstablefrom
copilot/add-cargo-deny-ci

Conversation

Copy link

Copilot AI commented Nov 27, 2025 •
edited by jimmygchen
Loading

Issue Addressed

Closes #8408

Proposed Changes

Adds cargo deny to CI to prevent dependency regressions by banning unwanted crates and detecting duplicate versions.

Configuration (deny.toml):

  • Bans legacy crates: ethers, ethereum-types, protobuf
  • Denies duplicate versions of reqwest specifically
  • Warns on other duplicate crates globally
  • Restricts sources to crates.io and sigp GitHub org

CI Integration:

  • Adds cargo-deny to the check-code job's tool list
  • Adds make deny-CI step to run the checks

Makefile:

  • deny-CI — runs cargo deny check bans sources
  • deny / install-deny — local development targets

Additional Info

The http crate currently has duplicates (0.2.12, 1.3.1), so it is not yet added to the deny list. Once consolidated, it can be added with deny-multiple-versions = true.

The multiple-versions = "warn" setting surfaces all duplicate crates as warnings without failing the build, while deny-multiple-versions = true on specific crates (like reqwest) causes hard failures.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

  • embarkstudios.github.io
    • Triggering command: /usr/bin/curl curl -s REDACTED (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

Original prompt

This section details on the original issue you should resolve

<issue_title>Run cargo deny or similar on CI</issue_title>
<issue_description>## Description

We're successfully getting our dependencies under control, but it would be nice to prevent regressions.

We could set up cargo deny on CI with a list of "banished" crates that we never want to see again, including:

  • ethers
  • ethereum-types
  • protobuf

There are also other crates, which once we remove duplicate versions, we would like to try to prevent reintroducing duplicates of, e.g.

  • http
  • reqwest

Reducing duplicates of heavy crates (particularly ones with build scripts) is a good way to reduce compilation time, as well as attack surface.
</issue_description>

<agent_instructions>Write as little code as possible to accomplish the task. Now that the reqwest consolidation PR is merged, you can include a deny rule for duplicates of reqwest</agent_instructions>

Comments on the Issue (you are @copilot in this section)

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

@cla-assistant
Copy link

cla-assistant bot commented Nov 27, 2025

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
You have signed the CLA already but the status is still pending? Let us recheck it.

1 similar comment
@cla-assistant
Copy link

cla-assistant bot commented Nov 27, 2025

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
You have signed the CLA already but the status is still pending? Let us recheck it.

@michaelsproul
Add cargo-deny for dependency control and CI integration
8463a92 
Co-authored-by: michaelsproul <4452260+michaelsproul@users.noreply.github.com>
Copilot AI changed the title [WIP] Add cargo deny setup to CI for banned crates Run cargo deny on CI Nov 27, 2025
Copilot AI requested a review from michaelsproul November 27, 2025 05:41
@michaelsproul michaelsproul marked this pull request as ready for review November 27, 2025 05:50
jimmygchen
jimmygchen reviewed Nov 28, 2025
View reviewed changes
Copy link
Member

@jimmygchen jimmygchen left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🤖 The PR description includes "Closes #6164" but that issue is about PeerDAS proposer peer counts, not cargo deny. Should only reference "Fixes #8408".

The PR description mentions the http crate duplicates will be added to the deny list later. Is there a GitHub issue to track this follow-up work?

@michaelsproul michaelsproul deleted the copilot/add-cargo-deny-ci branch December 15, 2025 03:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jimmygchen jimmygchen jimmygchen left review comments

@michaelsproul michaelsproul Awaiting requested review from michaelsproul

Assignees

@michaelsproul michaelsproul

Copilot code review Copilot

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@jimmygchen @michaelsproul