diff --git a/.github/AGENTS.md b/.github/AGENTS.md index ceaeed1f..0aaf8baf 100644 --- a/.github/AGENTS.md +++ b/.github/AGENTS.md @@ -16,6 +16,7 @@ binary points at that page. Renaming or removing an id silently drops the prefill for binaries that can never be updated retroactively. - Keep Linux system dependencies aligned with real build needs for Wayland, Cairo, Pango, GTK4/libadwaita, D-Bus, packaging, and Nix checks. +- `deny.toml` is the dependency policy and the `dependency-policy` job enforces it. Advisories report without blocking, so a new advisory cannot fail an unrelated pull request; bans, licenses, and sources block. - Do not weaken release checks or skip package layout/version validation without a documented reason. ## Coupled Changes diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 8ff15073..b19df8af 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -144,3 +144,26 @@ jobs: - name: Check flake package and development shell instantiation run: dotnet run tools/wayscriber.cs --no-build -- check nix-instantiation + + dependency-policy: + name: Dependency policy (${{ matrix.checks }}) + runs-on: ubuntu-latest + timeout-minutes: 10 + strategy: + fail-fast: false + matrix: + checks: + - advisories + - bans licenses sources + # A newly published advisory must not block unrelated pull requests. + continue-on-error: ${{ matrix.checks == 'advisories' }} + steps: + - name: Checkout + uses: actions/checkout@v4 + + - name: Check dependency policy + uses: EmbarkStudios/cargo-deny-action@v2 + with: + arguments: --workspace --locked + command: check ${{ matrix.checks }} + rust-version: 1.99.1 diff --git a/AGENTS.md b/AGENTS.md index 1f19ebe2..d0f4a16b 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -51,6 +51,7 @@ - Config changes often require `config.example.toml`, `docs/CONFIG.md`, configurator models/views, schema behavior, and tests. - Tool/action/keybinding changes often require config defaults, action metadata, help/command UI, toolbar UI, configurator labels/search, docs, and tests. - Daemon, service, shortcut, path, and packaging changes often need updates across `src/daemon/`, `src/paths/`, `src/systemd_user_service.rs`, `src/shortcut_hint.rs`, `configurator/src/app/daemon_setup/`, and `packaging/`. +- Dependency changes must satisfy `deny.toml`. A new license or duplicate version needs an entry there with its reason. ## Validation - Full local CI is `./tools/lint-and-test.sh`. It needs the .NET SDK selected by `global.json`. Without it, `cargo test` still runs the Rust source guards in `tests/repository_guards` (process sites, config writers, shared dependencies, use statements, no Python), but not the C# checks, including the source-coverage check that finds `.rs` files Cargo never compiles. diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index bda172f3..4407555b 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -139,6 +139,13 @@ Rust tests include the repository guards in `tests/repository_guards`. The sourc gate uses current rustc dep-info and rejects tracked or unignored `.rs` files that are outside the supported Cargo target/feature matrix. +Dependency changes must also satisfy the policy in `deny.toml`, which CI enforces in its own +job. The Nix shell includes `cargo-deny`; elsewhere, install it and run: + +```bash +cargo deny --workspace --locked check +``` + The all-feature portal transport tests require `dbus-daemon`. Each fixture owns a private session bus and connects through its explicit address, leaving the desktop session bus alone. diff --git a/Cargo.toml b/Cargo.toml index 11a74b88..fedf4467 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -3,6 +3,7 @@ name = "wayscriber" version = "0.9.28" edition = "2024" rust-version = "1.99.1" +license = "MIT" description = "Screen annotation tool for Wayland compositors" homepage = "https://wayscriber.com" repository = "https://github.com/devmobasa/wayscriber" diff --git a/configurator/Cargo.toml b/configurator/Cargo.toml index 0b9608ed..a41be09e 100644 --- a/configurator/Cargo.toml +++ b/configurator/Cargo.toml @@ -3,6 +3,8 @@ name = "wayscriber-configurator" version = "0.9.28" edition = "2024" rust-version = "1.99.1" +license = "MIT" +publish = false [lints] workspace = true diff --git a/deny.toml b/deny.toml new file mode 100644 index 00000000..d70375b6 --- /dev/null +++ b/deny.toml @@ -0,0 +1,42 @@ +# Dependency policy for the workspace. CI runs it in the `dependency-policy` job; +# `cargo deny --workspace --locked check` gives the same result locally. + +[graph] +all-features = true +targets = [ + { triple = "x86_64-unknown-linux-gnu" }, + { triple = "aarch64-unknown-linux-gnu" }, +] + +[advisories] +# zbus 6 absorbed these crates. ksni, which the `tray` feature needs, still +# requires zbus 5, so remove these entries once it moves. +ignore = [ + { id = "RUSTSEC-2026-0370", reason = "zvariant: blocked on ksni supporting zbus 6" }, + { id = "RUSTSEC-2026-0371", reason = "zbus_names: blocked on ksni supporting zbus 6" }, + { id = "RUSTSEC-2026-0372", reason = "zvariant_derive: blocked on ksni supporting zbus 6" }, +] + +[licenses] +allow = [ + "Apache-2.0", + "Apache-2.0 WITH LLVM-exception", + "MIT", + "Unicode-3.0", + "Unlicense", +] + +[bans] +multiple-versions = "deny" +wildcards = "deny" +allow-wildcard-paths = true +skip = [ + { crate = "miniz_oxide@0.8", reason = "png needs 0.8 while flate2 needs 0.9" }, + { crate = "syn@2", reason = "proc macros have not all moved to syn 3" }, + { crate = "system-deps@7", reason = "build-only: the GTK sys crates span three majors" }, + { crate = "system-deps@8", reason = "build-only: the GTK sys crates span three majors" }, +] + +[sources] +unknown-registry = "deny" +unknown-git = "deny" diff --git a/flake.nix b/flake.nix index 43b179a8..46258f24 100644 --- a/flake.nix +++ b/flake.nix @@ -32,6 +32,7 @@ servicePath = pkgs.lib.makeBinPath [ pkgs.grim pkgs.slurp pkgs.wl-clipboard ]; developmentInputs = with pkgs; [ rustToolchain + cargo-deny util-linux pkg-config cairo