ci: enforce a dependency policy with cargo-deny

Add deny.toml and a dependency-policy job covering the whole workspace.
Bans, licenses, and sources block; advisories report without blocking,
so a newly published advisory cannot fail an unrelated pull request.

zbus 6 absorbed zvariant, zvariant_derive, and zbus_names, so RustSec
now lists them as unmaintained. ksni still requires zbus 5, so those
advisories are ignored with that reason until it moves.

Both packages now state their MIT license instead of leaving the check
to detect it. The configurator is marked publish = false: it has an
unversioned path dependency and cannot be published.

.github/AGENTS.md

@@ -16,6 +16,7 @@
   binary points at that page. Renaming or removing an id silently drops the
   prefill for binaries that can never be updated retroactively.
 - Keep Linux system dependencies aligned with real build needs for Wayland, Cairo, Pango, GTK4/libadwaita, D-Bus, packaging, and Nix checks.
+- `deny.toml` is the dependency policy and the `dependency-policy` job enforces it. Advisories report without blocking, so a new advisory cannot fail an unrelated pull request; bans, licenses, and sources block.
 - Do not weaken release checks or skip package layout/version validation without a documented reason.
 
 ## Coupled Changes

.github/workflows/ci.yml

@@ -144,3 +144,26 @@ jobs:
 
       - name: Check flake package and development shell instantiation
         run: dotnet run tools/wayscriber.cs --no-build -- check nix-instantiation
+
+  dependency-policy:
+    name: Dependency policy (${{ matrix.checks }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    strategy:
+      fail-fast: false
+      matrix:
+        checks:
+          - advisories
+          - bans licenses sources
+    # A newly published advisory must not block unrelated pull requests.
+    continue-on-error: ${{ matrix.checks == 'advisories' }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Check dependency policy
+        uses: EmbarkStudios/cargo-deny-action@v2
+        with:
+          arguments: --workspace --locked
+          command: check ${{ matrix.checks }}
+          rust-version: 1.99.1

AGENTS.md

@@ -51,6 +51,7 @@
 - Config changes often require `config.example.toml`, `docs/CONFIG.md`, configurator models/views, schema behavior, and tests.
 - Tool/action/keybinding changes often require config defaults, action metadata, help/command UI, toolbar UI, configurator labels/search, docs, and tests.
 - Daemon, service, shortcut, path, and packaging changes often need updates across `src/daemon/`, `src/paths/`, `src/systemd_user_service.rs`, `src/shortcut_hint.rs`, `configurator/src/app/daemon_setup/`, and `packaging/`.
+- Dependency changes must satisfy `deny.toml`. A new license or duplicate version needs an entry there with its reason.
 
 ## Validation
 - Full local CI is `./tools/lint-and-test.sh`. It needs the .NET SDK selected by `global.json`. Without it, `cargo test` still runs the Rust source guards in `tests/repository_guards` (process sites, config writers, shared dependencies, use statements, no Python), but not the C# checks, including the source-coverage check that finds `.rs` files Cargo never compiles.

CONTRIBUTING.md

@@ -139,6 +139,13 @@ Rust tests include the repository guards in `tests/repository_guards`. The sourc
 gate uses current rustc dep-info and rejects tracked or unignored `.rs` files that are outside
 the supported Cargo target/feature matrix.
 
+Dependency changes must also satisfy the policy in `deny.toml`, which CI enforces in its own
+job. The Nix shell includes `cargo-deny`; elsewhere, install it and run:
+
+```bash
+cargo deny --workspace --locked check
+```
+
 The all-feature portal transport tests require `dbus-daemon`. Each fixture owns a private
 session bus and connects through its explicit address, leaving the desktop session bus alone.
 

Cargo.toml

@@ -3,6 +3,7 @@ name = "wayscriber"
 version = "0.9.28"
 edition = "2024"
 rust-version = "1.99.1"
+license = "MIT"
 description = "Screen annotation tool for Wayland compositors"
 homepage = "https://wayscriber.com"
 repository = "https://github.com/devmobasa/wayscriber"

configurator/Cargo.toml

@@ -3,6 +3,8 @@ name = "wayscriber-configurator"
 version = "0.9.28"
 edition = "2024"
 rust-version = "1.99.1"
+license = "MIT"
+publish = false
 
 [lints]
 workspace = true

deny.toml

@@ -0,0 +1,42 @@
+# Dependency policy for the workspace. CI runs it in the `dependency-policy` job;
+# `cargo deny --workspace --locked check` gives the same result locally.
+
+[graph]
+all-features = true
+targets = [
+    { triple = "x86_64-unknown-linux-gnu" },
+    { triple = "aarch64-unknown-linux-gnu" },
+]
+
+[advisories]
+# zbus 6 absorbed these crates. ksni, which the `tray` feature needs, still
+# requires zbus 5, so remove these entries once it moves.
+ignore = [
+    { id = "RUSTSEC-2026-0370", reason = "zvariant: blocked on ksni supporting zbus 6" },
+    { id = "RUSTSEC-2026-0371", reason = "zbus_names: blocked on ksni supporting zbus 6" },
+    { id = "RUSTSEC-2026-0372", reason = "zvariant_derive: blocked on ksni supporting zbus 6" },
+]
+
+[licenses]
+allow = [
+    "Apache-2.0",
+    "Apache-2.0 WITH LLVM-exception",
+    "MIT",
+    "Unicode-3.0",
+    "Unlicense",
+]
+
+[bans]
+multiple-versions = "deny"
+wildcards = "deny"
+allow-wildcard-paths = true
+skip = [
+    { crate = "miniz_oxide@0.8", reason = "png needs 0.8 while flate2 needs 0.9" },
+    { crate = "syn@2", reason = "proc macros have not all moved to syn 3" },
+    { crate = "system-deps@7", reason = "build-only: the GTK sys crates span three majors" },
+    { crate = "system-deps@8", reason = "build-only: the GTK sys crates span three majors" },
+]
+
+[sources]
+unknown-registry = "deny"
+unknown-git = "deny"

flake.nix

@@ -32,6 +32,7 @@
         servicePath = pkgs.lib.makeBinPath [ pkgs.grim pkgs.slurp pkgs.wl-clipboard ];
         developmentInputs = with pkgs; [
           rustToolchain
+          cargo-deny
           util-linux
           pkg-config
           cairo