From 41434c915ea35e4395a2eaf0e4585010787354a3 Mon Sep 17 00:00:00 2001 From: Ignas Baranauskas Date: Mon, 10 Aug 2026 12:59:52 +0100 Subject: [PATCH] ci(cargo-deny): add dependency audit with cargo-deny Add cargo-deny to check dependencies for vulnerabilities, license violations, and banned crates. Runs as a step in branch-checks for PRs and as a separate scheduled workflow for daily advisory scanning. Signed-off-by: Ignas Baranauskas --- .github/workflows/branch-checks.yml | 19 ++++++++ .github/workflows/cargo-deny.yml | 39 ++++++++++++++++ deny.toml | 70 +++++++++++++++++++++++++++++ mise.lock | 27 +++++++++++ mise.toml | 1 + tasks/ci.toml | 2 +- tasks/rust.toml | 9 ++++ 7 files changed, 166 insertions(+), 1 deletion(-) create mode 100644 .github/workflows/cargo-deny.yml create mode 100644 deny.toml diff --git a/.github/workflows/branch-checks.yml b/.github/workflows/branch-checks.yml index 53f467ff76..d53381c1e9 100644 --- a/.github/workflows/branch-checks.yml +++ b/.github/workflows/branch-checks.yml @@ -79,6 +79,25 @@ jobs: - name: Check license headers run: mise run license:check + cargo-deny: + name: Cargo Deny + needs: pr_metadata + if: needs.pr_metadata.outputs.should_run == 'true' + runs-on: linux-amd64-cpu8 + container: + image: ghcr.io/nvidia/openshell/ci:latest + credentials: + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + + - name: Install tools + run: mise install --locked + + - name: Check dependencies + run: mise run rust:deny:policy + rust: name: Rust (${{ matrix.runner }}) needs: pr_metadata diff --git a/.github/workflows/cargo-deny.yml b/.github/workflows/cargo-deny.yml new file mode 100644 index 0000000000..2756215cb0 --- /dev/null +++ b/.github/workflows/cargo-deny.yml @@ -0,0 +1,39 @@ +# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. +# SPDX-License-Identifier: Apache-2.0 + +name: Cargo Deny (scheduled) + +on: + schedule: + - cron: "23 7 * * *" + workflow_dispatch: + +env: + CARGO_TERM_COLOR: always + MISE_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + +permissions: + contents: read + packages: read + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +jobs: + cargo-deny: + name: Cargo Deny + runs-on: linux-amd64-cpu8 + container: + image: ghcr.io/nvidia/openshell/ci:latest + credentials: + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + + - name: Install tools + run: mise install --locked + + - name: Check dependencies + run: mise run rust:deny diff --git a/deny.toml b/deny.toml new file mode 100644 index 0000000000..c4dab12334 --- /dev/null +++ b/deny.toml @@ -0,0 +1,70 @@ +# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. +# SPDX-License-Identifier: Apache-2.0 + +# cargo-deny configuration +# https://embarkstudios.github.io/cargo-deny/ + +[graph] +all-features = true +no-default-features = false + +# -- Advisories (RustSec + NVD) ------------------------------------------------ +[advisories] +yanked = "warn" +unmaintained = "workspace" +maximum-db-staleness = "P30D" +ignore = [ + # Pre-existing advisories acknowledged at onboarding. Each should be + # resolved by upgrading the affected transitive dependency and then + # removing the ignore entry. + { id = "RUSTSEC-2026-0190", reason = "anyhow unsoundness in downcast_mut — awaiting upstream fix" }, + { id = "RUSTSEC-2026-0204", reason = "crossbeam-epoch pointer deref — transitive via metrics/quanta" }, + { id = "RUSTSEC-2023-0071", reason = "rsa Marvin attack — transitive via spiffe, no direct exposure" }, + { id = "RUSTSEC-2025-0134", reason = "rustls-pemfile unmaintained — transitive via older kube/hyper" }, + { id = "RUSTSEC-2026-0098", reason = "rustls-webpki URI name constraints — transitive via older rustls" }, + { id = "RUSTSEC-2026-0099", reason = "rustls-webpki wildcard name constraints — transitive via older rustls" }, + { id = "RUSTSEC-2026-0104", reason = "rustls-webpki CRL parsing panic — transitive via older rustls" }, + { id = "RUSTSEC-2025-0068", reason = "serde_yml unsound+unmaintained — direct dep, no maintained alternative yet" }, +] + +# -- Licenses ------------------------------------------------------------------ +[licenses] +confidence-threshold = 0.8 +unused-allowed-license = "allow" + +allow = [ + "Apache-2.0", + "Apache-2.0 WITH LLVM-exception", + "MIT", + "MIT-0", + "BSD-1-Clause", + "BSD-2-Clause", + "BSD-3-Clause", + "BSL-1.0", + "ISC", + "Zlib", + "0BSD", + "CC0-1.0", + "Unlicense", + "Unicode-3.0", + "CDLA-Permissive-2.0", +] + +[licenses.private] +ignore = true +registries = [] + +# -- Bans ---------------------------------------------------------------------- +[bans] +multiple-versions = "warn" +wildcards = "allow" +highlight = "all" +workspace-default-features = "allow" +external-default-features = "allow" + +# -- Sources ------------------------------------------------------------------- +[sources] +unknown-registry = "deny" +unknown-git = "deny" +allow-registry = ["https://github.com/rust-lang/crates.io-index"] +allow-git = [] diff --git a/mise.lock b/mise.lock index c6e89eced7..1c60e6bb69 100644 --- a/mise.lock +++ b/mise.lock @@ -55,6 +55,33 @@ checksum = "sha256:d5c38fb914bbad57c6a7d58c4847315bc3fe11efbe4fb51b3c515f997a56c url = "https://github.com/EmbarkStudios/cargo-about/releases/download/0.8.4/cargo-about-0.8.4-x86_64-pc-windows-msvc.tar.gz" url_api = "https://api.github.com/repos/EmbarkStudios/cargo-about/releases/assets/324269449" +[[tools."github:EmbarkStudios/cargo-deny"]] +version = "0.20.2" +backend = "github:EmbarkStudios/cargo-deny" + +[tools."github:EmbarkStudios/cargo-deny".options] +version_prefix = "" + +[tools."github:EmbarkStudios/cargo-deny"."platforms.linux-arm64"] +checksum = "sha256:995c82be0defc7a025cae49a2aa2644ce8245c9a3318fc4103907c6a285e8c7d" +url = "https://github.com/EmbarkStudios/cargo-deny/releases/download/0.20.2/cargo-deny-0.20.2-aarch64-unknown-linux-musl.tar.gz" +url_api = "https://api.github.com/repos/EmbarkStudios/cargo-deny/releases/assets/471598345" + +[tools."github:EmbarkStudios/cargo-deny"."platforms.linux-x64"] +checksum = "sha256:9f12ed4c49936e09b48bf862b595cde2fe64fcbd9d74dfacac6131ca824c8d5f" +url = "https://github.com/EmbarkStudios/cargo-deny/releases/download/0.20.2/cargo-deny-0.20.2-x86_64-unknown-linux-musl.tar.gz" +url_api = "https://api.github.com/repos/EmbarkStudios/cargo-deny/releases/assets/471598214" + +[tools."github:EmbarkStudios/cargo-deny"."platforms.macos-arm64"] +checksum = "sha256:fe67d82a10d8597a3549364cb733a3f9cc1bfff9031b7ae46384a9f2a72090c3" +url = "https://github.com/EmbarkStudios/cargo-deny/releases/download/0.20.2/cargo-deny-0.20.2-aarch64-apple-darwin.tar.gz" +url_api = "https://api.github.com/repos/EmbarkStudios/cargo-deny/releases/assets/471597689" + +[tools."github:EmbarkStudios/cargo-deny"."platforms.windows-x64"] +checksum = "sha256:975a22143262fd27476d19ee00c7af67978426e40e1dee94eed6bbade1cf87dc" +url = "https://github.com/EmbarkStudios/cargo-deny/releases/download/0.20.2/cargo-deny-0.20.2-x86_64-pc-windows-msvc.tar.gz" +url_api = "https://api.github.com/repos/EmbarkStudios/cargo-deny/releases/assets/471599057" + [[tools."github:anchore/syft"]] version = "1.44.0" backend = "github:anchore/syft" diff --git a/mise.toml b/mise.toml index ed6065cb62..e8cfea0c49 100644 --- a/mise.toml +++ b/mise.toml @@ -40,6 +40,7 @@ skaffold = { version = "2.20.0", os = ["linux", "macos"] } k3d = { version = "5.8.3", os = ["macos"] } "github:anchore/syft" = { version = "1.44.0" } "github:EmbarkStudios/cargo-about" = { version = "0.8.4", version_prefix = "" } +"github:EmbarkStudios/cargo-deny" = { version = "0.20.2", version_prefix = "" } zig = "0.14.1" "github:rust-cross/cargo-zigbuild" = "0.22.3" "npm:markdownlint-cli2" = "0.22.0" diff --git a/tasks/ci.toml b/tasks/ci.toml index 7294da9d05..38e428cf48 100644 --- a/tasks/ci.toml +++ b/tasks/ci.toml @@ -56,7 +56,7 @@ hide = true [ci] description = "Run full checks (lint, compile/type checks, and tests)" -depends = ["lint", "check", "test", "go:ci"] +depends = ["lint", "check", "test", "go:ci", "rust:deny:policy"] [all] description = "Alias for ci" diff --git a/tasks/rust.toml b/tasks/rust.toml index 4d4893cf8a..8ca47d7efe 100644 --- a/tasks/rust.toml +++ b/tasks/rust.toml @@ -34,6 +34,15 @@ run = [ ] hide = true +["rust:deny"] +description = "Check dependencies for all cargo-deny rules" +run = "cargo deny check" + +["rust:deny:policy"] +description = "Check dependencies for license violations, bans, and source restrictions" +run = "cargo deny check licenses bans sources" + + ["rust:verify:telemetry-off"] description = "Verify telemetry emission code is compiled out with --no-default-features" run = [