CI: Add cargo deny as a pre-merge CI check #3699

Activity

1. github-actions

   added

   good first issueGood for newcomersGood for newcomers

   on Jul 18, 2026
2. github-actions

   assigned

   ryerraguntla

   on Jul 18, 2026
3. ryerraguntla

   changed the title [-]feat(security): Add `cargo deny` as a pre-merge CI check[/-] [+]feat(ci/cd): Add `cargo deny` as a pre-merge CI check[/+] on Jul 18, 2026
4. ryerraguntla commented on Jul 18, 2026

   

   ryerraguntla

   on Jul 18, 2026

   Last edited by krishvishal

   ContributorAuthor

   More actions

   
   **** ==========================================**
   ** cargo-deny Configuration Template**
   
    --- 1. Advisory Checks ---**
    Checks for known vulnerabilities or unmaintained crates in the RustSec database.**
   [advisories]
   db-path = "~/.cargo/advisory-db"
   db-urls = ["https://github.com/rustsec/advisory-db"]
   Fail the build if a crate with a known vulnerability is found.**
   vulnerability = "deny"
    Warn (instead of fail) if a crate is unmaintained or deprecated.**
   unmaintained = "warn"
    Warn on yanked crates, as they are no longer officially supported.**
   yanked = "warn"
   ignore = [
       "RUSTSEC-2021-XXXX" # Uncomment and add specific advisory IDs to ignore**
   ]
   
    --- 2. Dependency Bans ---**
    Allows you to explicitly allow, deny, or skip specific crates.**
   [bans]
   Fail the build if multiple versions of the same crate are used (uncomment to enforce).**
    multiple-versions = "deny"**
    Fail the build if a crate can't be resolved (e.g., missing dependencies).**
   highlight = "all"
   skip = [
        "some-crate" # Add crates to skip version/ban checks**
   ]
   deny = [
        "unwanted-crate" # Add crates you strictly want to prevent**
   ]
   
   --- 3. License Checks ---**
    Enforces your open-source or commercial compliance requirements.**
   [licenses]
    Fail the build if a dependency doesn't specify a license.**
   unlicensed = "deny"
   Allow specific popular open-source licenses.**
   allow = [
       "MIT",
       "Apache-2.0",
       "BSD-2-Clause",
       "BSD-3-Clause",
   ]
   
   Fail the build if a dependency uses a strictly disallowed license.**
   deny = [
       "GPL-3.0",
       "AGPL-3.0",
   ]
    Warn if the license is considered copyleft (requires sharing code).**
   copyleft = "warn"
    Allow exception for custom licenses or non-standard naming (specify exact file).**
   exceptions = [
       { allow = [" MPL-2.0"], name = "some-crate" }**
   ]
   
   --- 4. Source Checks ---**
    Controls where your dependencies are allowed to be downloaded from.**
   [sources]
    Fail the build if dependencies are from unknown/malicious sources.**
   unknown-registry = "deny"
   unknown-git = "deny"
   allow-org = true
   allow-community = true
    Whitelist private or internal registries if applicable.**
   allow-git = [
       "https://github.com"
   ]
   
5. justinmclean commented on Oct 9, 2026

   

   justinmclean

   on Oct 9, 2026

   Member

   More actions

   @ryerraguntla checking in, this is labelled good first issue but has been self-assigned since 18 Jul with just a draft config pasted. Still working on it, or should the assignment come off so a newcomer can pick it up?
6. ryerraguntla

   removed their assignment

   on Oct 10, 2026
7. the4amfriend commented on Oct 22, 2026

   

   the4amfriend

   on Oct 22, 2026

   More actions

   @justinmclean Hey, can I pick this up if nobody is working on it?
8. justinmclean

   added

   CI/CDContinuous integration and deploymentContinuous integration and deployment

   on Oct 22, 2026
9. justinmclean

   assigned

   the4amfriend

   on Oct 25, 2026
10. the4amfriend commented on Oct 25, 2026

    

    the4amfriend

    on Oct 25, 2026

    More actions

    @ryerraguntla The issue mentions an audit-remediation sibling issue for seeding the cargo-deny ignore list. I found discussion #3678 and issue #3700, but couldn't locate the remediation issue. Was it created? If so, could you link it?

    I've been testing the cargo-deny configuration locally, and the advisory check currently reports 24 RustSec advisories (12 vulnerabilities and 12 unmaintained dependencies).

    I'd like to avoid suppressing security findings without an agreed-upon baseline before submitting a PR. Could you clarify which advisories should be addressed or accepted as known risks?

    Thanks!
11. hubcio

    changed the title [-]feat(ci/cd): Add `cargo deny` as a pre-merge CI check[/-] [+]CI: Add `cargo deny` as a pre-merge CI check[/+] on Oct 28, 2026
12. github-actions

    assigned

    ryerraguntla

    on Oct 28, 2026