ci(cargo-deny): add dependency audit with cargo-deny

.github/workflows/branch-checks.yml

@@ -79,6 +79,25 @@ jobs:
  - name: Check license headers
  run: mise run license:check
 
+ cargo-deny:
+ name: Cargo Deny
+ needs: pr_metadata
+ if: needs.pr_metadata.outputs.should_run == 'true'
+ runs-on: linux-amd64-cpu8
+ container:
+ image: ghcr.io/nvidia/openshell/ci:latest
+ credentials:
+ username: ${{ github.actor }}
+ password: ${{ secrets.GITHUB_TOKEN }}
+ steps:
+ - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+ - name: Install tools
+ run: mise install --locked
+
+ - name: Check dependencies
+ run: mise run rust:deny:policy
+
  rust:
  name: Rust (${{ matrix.runner }})
  needs: pr_metadata

.github/workflows/cargo-deny.yml

@@ -0,0 +1,39 @@
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+name: Cargo Deny (scheduled)
+
+on:
+ schedule:
+ - cron: "23 7 * * *"
+ workflow_dispatch:
+
+env:
+ CARGO_TERM_COLOR: always
+ MISE_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+permissions:
+ contents: read
+ packages: read
+
+concurrency:
+ group: ${{ github.workflow }}-${{ github.ref }}
+ cancel-in-progress: true
+
+jobs:
+ cargo-deny:
+ name: Cargo Deny
+ runs-on: linux-amd64-cpu8
+ container:
+ image: ghcr.io/nvidia/openshell/ci:latest
+ credentials:
+ username: ${{ github.actor }}
+ password: ${{ secrets.GITHUB_TOKEN }}
+ steps:
+ - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+ - name: Install tools
+ run: mise install --locked
+
+ - name: Check dependencies
+ run: mise run rust:deny

deny.toml

@@ -0,0 +1,70 @@
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+# cargo-deny configuration
+# https://embarkstudios.github.io/cargo-deny/
+
+[graph]
+all-features = true
+no-default-features = false
+
+# -- Advisories (RustSec + NVD) ------------------------------------------------
+[advisories]
+yanked = "warn"
+unmaintained = "workspace"
+maximum-db-staleness = "P30D"
+ignore = [
+ # Pre-existing advisories acknowledged at onboarding. Each should be
+ # resolved by upgrading the affected transitive dependency and then
+ # removing the ignore entry.
+ { id = "RUSTSEC-2026-0190", reason = "anyhow unsoundness in downcast_mut — awaiting upstream fix" },
+ { id = "RUSTSEC-2026-0204", reason = "crossbeam-epoch pointer deref — transitive via metrics/quanta" },
+ { id = "RUSTSEC-2023-0071", reason = "rsa Marvin attack — transitive via spiffe, no direct exposure" },
+ { id = "RUSTSEC-2025-0134", reason = "rustls-pemfile unmaintained — transitive via older kube/hyper" },
+ { id = "RUSTSEC-2026-0098", reason = "rustls-webpki URI name constraints — transitive via older rustls" },
+ { id = "RUSTSEC-2026-0099", reason = "rustls-webpki wildcard name constraints — transitive via older rustls" },
+ { id = "RUSTSEC-2026-0104", reason = "rustls-webpki CRL parsing panic — transitive via older rustls" },
+ { id = "RUSTSEC-2025-0068", reason = "serde_yml unsound+unmaintained — direct dep, no maintained alternative yet" },
+]
+
+# -- Licenses ------------------------------------------------------------------
+[licenses]
+confidence-threshold = 0.8
+unused-allowed-license = "allow"
+
+allow = [
+ "Apache-2.0",
+ "Apache-2.0 WITH LLVM-exception",
+ "MIT",
+ "MIT-0",
+ "BSD-1-Clause",
+ "BSD-2-Clause",
+ "BSD-3-Clause",
+ "BSL-1.0",
+ "ISC",
+ "Zlib",
+ "0BSD",
+ "CC0-1.0",
+ "Unlicense",
+ "Unicode-3.0",
+ "CDLA-Permissive-2.0",
+]
+
+[licenses.private]
+ignore = true
+registries = []
+
+# -- Bans ----------------------------------------------------------------------
+[bans]
+multiple-versions = "warn"
+wildcards = "allow"
+highlight = "all"
+workspace-default-features = "allow"
+external-default-features = "allow"
+
+# -- Sources -------------------------------------------------------------------
+[sources]
+unknown-registry = "deny"
+unknown-git = "deny"
+allow-registry = ["https://github.com/rust-lang/crates.io-index"]
+allow-git = []

mise.toml

@@ -40,6 +40,7 @@ skaffold = { version = "2.20.0", os = ["linux", "macos"] }
 k3d = { version = "5.8.3", os = ["macos"] }
 "github:anchore/syft" = { version = "1.44.0" }
 "github:EmbarkStudios/cargo-about" = { version = "0.8.4", version_prefix = "" }
+"github:EmbarkStudios/cargo-deny" = { version = "0.20.2", version_prefix = "" }
 zig = "0.14.1"
 "github:rust-cross/cargo-zigbuild" = "0.22.3"
 "npm:markdownlint-cli2" = "0.22.0"

tasks/ci.toml

@@ -56,7 +56,7 @@ hide = true
 
 [ci]
 description = "Run full checks (lint, compile/type checks, and tests)"
-depends = ["lint", "check", "test", "go:ci"]
+depends = ["lint", "check", "test", "go:ci", "rust:deny:policy"]
 
 [all]
 description = "Alias for ci"

tasks/rust.toml

@@ -34,6 +34,15 @@ run = [
 ]
 hide = true
 
+["rust:deny"]
+description = "Check dependencies for all cargo-deny rules"
+run = "cargo deny check"
+
+["rust:deny:policy"]
+description = "Check dependencies for license violations, bans, and source restrictions"
+run = "cargo deny check licenses bans sources"
+
+
 ["rust:verify:telemetry-off"]
 description = "Verify telemetry emission code is compiled out with --no-default-features"
 run = [