From e009114d63b373e2005aff2664ef68ef6fd11358 Mon Sep 17 00:00:00 2001 From: devmobasa <4170275+devmobasa@users.noreply.github.com> Date: Fri, 30 Oct 2026 19:24:09 +0100 Subject: [PATCH] ci: enforce a dependency policy with cargo-deny Add deny.toml and a dependency-policy job covering the whole workspace. Bans, licenses, and sources block; advisories report without blocking, so a newly published advisory cannot fail an unrelated pull request. zbus 6 absorbed zvariant, zvariant_derive, and zbus_names, so RustSec now lists them as unmaintained. ksni still requires zbus 5, so those advisories are ignored with that reason until it moves. Both packages now state their MIT license instead of leaving the check to detect it. The configurator is marked publish = false: it has an unversioned path dependency and cannot be published. --- .github/AGENTS.md | 1 + .github/workflows/ci.yml | 23 ++++++++++++++++++++++ AGENTS.md | 1 + CONTRIBUTING.md | 7 +++++++ Cargo.toml | 1 + configurator/Cargo.toml | 2 ++ deny.toml | 42 ++++++++++++++++++++++++++++++++++++++++ flake.nix | 1 + 8 files changed, 78 insertions(+) create mode 100644 deny.toml diff --git a/.github/AGENTS.md b/.github/AGENTS.md index ceaeed1f..0aaf8baf 100644 --- a/.github/AGENTS.md +++ b/.github/AGENTS.md @@ -16,6 +16,7 @@ binary points at that page. Renaming or removing an id silently drops the prefill for binaries that can never be updated retroactively. - Keep Linux system dependencies aligned with real build needs for Wayland, Cairo, Pango, GTK4/libadwaita, D-Bus, packaging, and Nix checks. +- `deny.toml` is the dependency policy and the `dependency-policy` job enforces it. Advisories report without blocking, so a new advisory cannot fail an unrelated pull request; bans, licenses, and sources block. - Do not weaken release checks or skip package layout/version validation without a documented reason. ## Coupled Changes diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 8ff15073..b19df8af 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -144,3 +144,26 @@ jobs: - name: Check flake package and development shell instantiation run: dotnet run tools/wayscriber.cs --no-build -- check nix-instantiation + + dependency-policy: + name: Dependency policy (${{ matrix.checks }}) + runs-on: ubuntu-latest + timeout-minutes: 10 + strategy: + fail-fast: false + matrix: + checks: + - advisories + - bans licenses sources + # A newly published advisory must not block unrelated pull requests. + continue-on-error: ${{ matrix.checks == 'advisories' }} + steps: + - name: Checkout + uses: actions/checkout@v4 + + - name: Check dependency policy + uses: EmbarkStudios/cargo-deny-action@v2 + with: + arguments: --workspace --locked + command: check ${{ matrix.checks }} + rust-version: 1.99.1 diff --git a/AGENTS.md b/AGENTS.md index 1f19ebe2..d0f4a16b 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -51,6 +51,7 @@ - Config changes often require `config.example.toml`, `docs/CONFIG.md`, configurator models/views, schema behavior, and tests. - Tool/action/keybinding changes often require config defaults, action metadata, help/command UI, toolbar UI, configurator labels/search, docs, and tests. - Daemon, service, shortcut, path, and packaging changes often need updates across `src/daemon/`, `src/paths/`, `src/systemd_user_service.rs`, `src/shortcut_hint.rs`, `configurator/src/app/daemon_setup/`, and `packaging/`. +- Dependency changes must satisfy `deny.toml`. A new license or duplicate version needs an entry there with its reason. ## Validation - Full local CI is `./tools/lint-and-test.sh`. It needs the .NET SDK selected by `global.json`. Without it, `cargo test` still runs the Rust source guards in `tests/repository_guards` (process sites, config writers, shared dependencies, use statements, no Python), but not the C# checks, including the source-coverage check that finds `.rs` files Cargo never compiles. diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index bda172f3..4407555b 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -139,6 +139,13 @@ Rust tests include the repository guards in `tests/repository_guards`. The sourc gate uses current rustc dep-info and rejects tracked or unignored `.rs` files that are outside the supported Cargo target/feature matrix. +Dependency changes must also satisfy the policy in `deny.toml`, which CI enforces in its own +job. The Nix shell includes `cargo-deny`; elsewhere, install it and run: + +```bash +cargo deny --workspace --locked check +``` + The all-feature portal transport tests require `dbus-daemon`. Each fixture owns a private session bus and connects through its explicit address, leaving the desktop session bus alone. diff --git a/Cargo.toml b/Cargo.toml index 11a74b88..fedf4467 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -3,6 +3,7 @@ name = "wayscriber" version = "0.9.28" edition = "2024" rust-version = "1.99.1" +license = "MIT" description = "Screen annotation tool for Wayland compositors" homepage = "https://wayscriber.com" repository = "https://github.com/devmobasa/wayscriber" diff --git a/configurator/Cargo.toml b/configurator/Cargo.toml index 0b9608ed..a41be09e 100644 --- a/configurator/Cargo.toml +++ b/configurator/Cargo.toml @@ -3,6 +3,8 @@ name = "wayscriber-configurator" version = "0.9.28" edition = "2024" rust-version = "1.99.1" +license = "MIT" +publish = false [lints] workspace = true diff --git a/deny.toml b/deny.toml new file mode 100644 index 00000000..d70375b6 --- /dev/null +++ b/deny.toml @@ -0,0 +1,42 @@ +# Dependency policy for the workspace. CI runs it in the `dependency-policy` job; +# `cargo deny --workspace --locked check` gives the same result locally. + +[graph] +all-features = true +targets = [ + { triple = "x86_64-unknown-linux-gnu" }, + { triple = "aarch64-unknown-linux-gnu" }, +] + +[advisories] +# zbus 6 absorbed these crates. ksni, which the `tray` feature needs, still +# requires zbus 5, so remove these entries once it moves. +ignore = [ + { id = "RUSTSEC-2026-0370", reason = "zvariant: blocked on ksni supporting zbus 6" }, + { id = "RUSTSEC-2026-0371", reason = "zbus_names: blocked on ksni supporting zbus 6" }, + { id = "RUSTSEC-2026-0372", reason = "zvariant_derive: blocked on ksni supporting zbus 6" }, +] + +[licenses] +allow = [ + "Apache-2.0", + "Apache-2.0 WITH LLVM-exception", + "MIT", + "Unicode-3.0", + "Unlicense", +] + +[bans] +multiple-versions = "deny" +wildcards = "deny" +allow-wildcard-paths = true +skip = [ + { crate = "miniz_oxide@0.8", reason = "png needs 0.8 while flate2 needs 0.9" }, + { crate = "syn@2", reason = "proc macros have not all moved to syn 3" }, + { crate = "system-deps@7", reason = "build-only: the GTK sys crates span three majors" }, + { crate = "system-deps@8", reason = "build-only: the GTK sys crates span three majors" }, +] + +[sources] +unknown-registry = "deny" +unknown-git = "deny" diff --git a/flake.nix b/flake.nix index 43b179a8..46258f24 100644 --- a/flake.nix +++ b/flake.nix @@ -32,6 +32,7 @@ servicePath = pkgs.lib.makeBinPath [ pkgs.grim pkgs.slurp pkgs.wl-clipboard ]; developmentInputs = with pkgs; [ rustToolchain + cargo-deny util-linux pkg-config cairo