Skip to content

chore: add cargo-deny + dependency-review + commitlint workflows #31

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
satyakwok merged 2 commits into from
May 13, 2026
Merged

chore: add cargo-deny + dependency-review + commitlint workflows #31

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
29427dd
chore: add cargo-deny + dependency-review + commitlint workflows
satyakwok May 13, 2026
397b0d3
fix(deny): ignore RUSTSEC-2024-0436/0134 + allow BSL-1.0
satyakwok May 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions .commitlintrc.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
{
"extends": ["@commitlint/config-conventional"],
"rules": {
"header-max-length": [2, "always", 100],
"body-max-line-length": [0, "always"],
"footer-max-line-length": [0, "always"],
"type-enum": [2, "always", [
"build", "chore", "ci", "docs", "feat", "fix",
"perf", "refactor", "revert", "style", "test"
]]
}
}
26 changes: 26 additions & 0 deletions .github/workflows/cargo-deny.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,26 @@
name: cargo-deny

# License + advisory + ban policy enforcement via deny.toml. Runs on PR
# + push to main + manual dispatch. Mirrors the cargo-deny gate already
# running on the chain repo (sentrix-labs/sentrix).

on:
pull_request:
branches: [main]
push:
branches: [main]
workflow_dispatch:

permissions:
contents: read

jobs:
cargo-deny:
name: cargo-deny (licenses + advisories + bans)
runs-on: ubuntu-22.04
steps:
- uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
- uses: EmbarkStudios/cargo-deny-action@6c8f9facfa5047ec02d8485b6bf52b587b7777d1 # v2
with:
command: check
arguments: --all-features
22 changes: 22 additions & 0 deletions .github/workflows/commitlint.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,22 @@
name: commitlint

on:
pull_request:
branches: [main]

permissions:
contents: read
pull-requests: read

jobs:
commitlint:
name: commitlint
runs-on: ubuntu-22.04
steps:
- uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
with:
fetch-depth: 0

- uses: wagoid/commitlint-github-action@b948419dd99f3fd78a6548d48f94e3df7f6bf3ed # v6
with:
configFile: .commitlintrc.json
30 changes: 30 additions & 0 deletions .github/workflows/dependency-review.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,30 @@
name: Dependency review

# Runs GitHub's dependency-review-action on PRs. Diffs the lockfile
# changes vs the base branch and BLOCKS merge if newly-introduced
# dependencies have HIGH-severity vulnerabilities OR licenses outside
# our allowlist. Complements cargo-deny (full-tree post-merge gate)
# with a pre-merge diff-only gate.

on:
pull_request:
branches: [main]

permissions:
contents: read
pull-requests: write

jobs:
dependency-review:
name: Dependency review
runs-on: ubuntu-22.04
steps:
- uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5

- uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4
with:
fail-on-severity: high
# Mirror deny.toml [licenses].allow.
allow-licenses: MIT, Apache-2.0, Apache-2.0 WITH LLVM-exception, BSD-2-Clause, BSD-3-Clause, ISC, MPL-2.0, Unicode-DFS-2016, Unicode-3.0, CC0-1.0, Zlib, 0BSD, BUSL-1.1, CDLA-Permissive-2.0
allow-dependencies-licenses: pkg:githubactions/Swatinem/rust-cache
comment-summary-in-pr: on-failure
55 changes: 55 additions & 0 deletions deny.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,55 @@
# cargo-deny configuration. Loaded by .github/workflows/cargo-deny.yml.
# See https://embarkstudios.github.io/cargo-deny/

[graph]
all-features = true

[advisories]
yanked = "deny"
ignore = [
# `paste` is unmaintained (author archived) but still a transitive dep
# of alloy / sqlx / prost. No vulnerability — just dormant. Mirrors
# the ignore in indexer-rs + the chain repo.
"RUSTSEC-2024-0436",
# `rustls-pemfile` is deprecated in favour of `rustls-pki-types`;
# transitive via reqwest -> rustls. No vulnerability.
"RUSTSEC-2025-0134",
]

[licenses]
unused-allowed-license = "allow"
confidence-threshold = 0.8
allow = [
"MIT",
"Apache-2.0",
"Apache-2.0 WITH LLVM-exception",
"BSD-2-Clause",
"BSD-3-Clause",
"ISC",
"MPL-2.0",
"Unicode-DFS-2016",
"Unicode-3.0",
"CC0-1.0",
"Zlib",
"0BSD",
"BUSL-1.1",
# webpki-roots v1.x: CDLA-Permissive-2.0 (transitive via reqwest -> rustls).
"CDLA-Permissive-2.0",
# Boost Software License — permissive OSI-approved, transitive via
# xxhash-rust used by leptos's hashing layer.
"BSL-1.0",
]
Comment on lines +22 to +41
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot May 13, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

# First, locate and examine the deny.toml file
find . -name "deny.toml" -type f

Repository: Sentriscloud/sentrix-explorer-v2

Length of output: 88

🏁 Script executed:

# Check the full deny.toml file to understand structure
cat deny.toml

Repository: Sentriscloud/sentrix-explorer-v2

Length of output: 1551

🌐 Web query:

cargo-deny per-crate license exceptions allow

💡 Result:

cargo-deny does support per-crate license exceptions, and they’re configured under the [licenses] section via an exceptions array using crate selectors (PackageSpecs) so you can allow additional licenses for specific crates only (instead of allowing that license globally across the whole dependency graph). [1] Example (deny.toml or project exceptions file): exceptions = [ # This exception applies only to the specified crate (and optional version constraints) { crate = "inferno", allow = ["CDDL-1.0"] }, ] This is explicitly described as: the exceptions field “is meant to allow additional licenses only for particular crates” and uses PackageSpecs to select “the crate the exception applies to.” [1] Notes that matter for “allow”: - The general [licenses] allow list applies to the entire crate graph, meaning any license you allow there becomes permitted for any crate that matches the license checker (including crates that may introduce that license later). [1] - The exceptions mechanism exists to make those additional allowances more selective and avoid implicitly allowing licenses in future/unrelated dependency paths. [1]

Citations:

🏁 Script executed:

# Search for BUSL-1.1 references in lock files or dependencies
find . -name "Cargo.lock" -o -name "Cargo.toml" | head -5

Repository: Sentriscloud/sentrix-explorer-v2

Length of output: 102

🏁 Script executed:

# Check for any crates or dependencies that might use BUSL-1.1
rg "BUSL" --type toml

Repository: Sentriscloud/sentrix-explorer-v2

Length of output: 134

🏁 Script executed:

# Check if there's a Cargo.lock file to see which crates use BUSL-1.1
head -100 Cargo.lock

Repository: Sentriscloud/sentrix-explorer-v2

Length of output: 2650

🏁 Script executed:

# Search the full Cargo.lock for any BUSL-1.1 licensed dependencies
rg "license.*BUSL-1.1" Cargo.lock -A 5 -B 5

Repository: Sentriscloud/sentrix-explorer-v2

Length of output: 58

🏁 Script executed:

# More comprehensive search for BUSL in Cargo.lock
rg -i "busl" Cargo.lock -A 10 -B 10

Repository: Sentriscloud/sentrix-explorer-v2

Length of output: 58

🏁 Script executed:

# Check if there are actual crates with BUSL-1.1 in the lock file
wc -l Cargo.lock

Repository: Sentriscloud/sentrix-explorer-v2

Length of output: 92

🏁 Script executed:

# Search for package names that might have BUSL-1.1
grep -n "^\[\[package\]\]" Cargo.lock | tail -20

Repository: Sentriscloud/sentrix-explorer-v2

Length of output: 416

🌐 Web query:

cargo-deny project own license vs dependencies BUSL-1.1

💡 Result:

cargo-deny checks licenses for all crates in the dependency graph (dependencies and transitive deps), but does not check the project's own license specified in its Cargo.toml[1][2]. The licenses check (cargo deny check licenses) evaluates every crate's license expression against the deny.toml configuration to ensure acceptable terms[1][2][3]. BUSL-1.1 (Business Source License 1.1) is a valid SPDX identifier[4]. It is not OSI-approved or FSF Free/Libre[4][5], so with default allow-osi-fsf-free = "neither" and no explicit allow/deny, it falls to default = "deny" (implicitly rejected)[1][6][3][7]. To allow BUSL-1.1 in dependencies: - Add "BUSL-1.1" to [licenses].allow (allows everywhere)[3]. - Or use per-crate exceptions: exceptions = [ { allow = ["BUSL-1.1"], crate = "specific-crate" } ][8][9][3]. Examples: - wasmer-upstream allows BUSL-1.1 for specific crates like wasmer-compiler-singlepass[8]. - vouch-sh uses exception for its own vouch-server crate under BUSL-1.1 and clarifies the license file[9]. The project's own license is irrelevant to cargo-deny's licenses check; configure policies based on what deps are acceptable regardless of your project's license[10].

Citations:

Move BUSL-1.1 from global allow list to a crate-specific exception.

BUSL-1.1 is restrictive and non-OSI-approved. Keeping it globally allowlisted means any future BUSL-1.1 dependency automatically passes without review. Use cargo-deny's exceptions mechanism instead to scope this to specific crates only:

Example 
[licenses]
allow = [
    "MIT",
    "Apache-2.0",
    # ... other licenses ...
]

exceptions = [
    { crate = "specific-crate-name", allow = ["BUSL-1.1"] },
]

This follows the pattern used by other projects (wasmer, vouch) for restrictive licenses and ensures each BUSL-1.1 dependency receives explicit evaluation.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@deny.toml` around lines 22 - 41, The global licenses.allow list currently
contains "BUSL-1.1" which should be removed and instead added as a crate-scoped
exception using cargo-deny's exceptions; remove the "BUSL-1.1" entry from the
allow array and add an exceptions entry under the [licenses] section (exceptions
= [ { crate = "specific-crate-name", allow = ["BUSL-1.1"] } ]) targeting the
exact crate(s) that need BUSL-1.1 so the rest of the repo no longer globally
allowlists that restrictive license.

Copy link
Copy Markdown
Member Author

@satyakwok satyakwok May 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Skip — same forward-compat reasoning as sister comments on sdk-rs#22 + sentrix-grpc-wasm#16. Sentrix Chain workspace crates are all BUSL-1.1; if explorer-v2 ever adds a path-dep on a chain crate (currently only depends on sentrix-proto v0.1.1 from crates.io which is BUSL-1.1 already in tree) the allowlist needs BUSL-1.1. Acknowledging the per-crate exceptions mechanism would be more precise — defer until the dep tree stabilises post-migration.

Copy link
Copy Markdown

@coderabbitai coderabbitai Bot May 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@satyakwok, understood — the global BUSL-1.1 allowlist is intentional given that Sentrix Chain workspace crates are all BUSL-1.1 and sentrix-proto v0.1.1 (already in tree) carries that license. Deferring the migration to per-crate exceptions until the dep tree stabilises post-migration makes sense. I'll note this context to avoid re-raising it in future reviews.

(ᵔᴥᵔ)

✏️ Learnings added 
Learnt from: satyakwok
Repo: Sentriscloud/sentrix-explorer-v2 PR: 31
File: deny.toml:22-41
Timestamp: 2026-05-13T17:31:57.824Z
Learning: In the Sentriscloud/sentrix-explorer-v2 repository, `BUSL-1.1` is intentionally kept in the global `[licenses].allow` list in `deny.toml` because Sentrix Chain workspace crates are all licensed under BUSL-1.1, and `sentrix-proto v0.1.1` (from crates.io) — already a direct dependency — carries BUSL-1.1. The plan is to migrate to per-crate `exceptions` once the dependency tree stabilises post-migration. Do not flag BUSL-1.1 in the global allowlist as an issue in this repo. The same reasoning applies to sister repos sdk-rs and sentrix-grpc-wasm.

Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure review instructions. You can manage existing learnings in the app.


[bans]
# Multiple major versions tolerated for now (leptos + alloy ecosystems
# regularly need two majors during migration). Tighten later if a
# specific crate becomes the problem.
multiple-versions = "warn"
wildcards = "warn"
allow-wildcard-paths = true
highlight = "all"

[sources]
unknown-registry = "deny"
unknown-git = "deny"
allow-git = []
Loading