Skip to content

chore: add cargo-deny + dependency-review + commitlint workflows #22

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
satyakwok merged 2 commits into from
May 13, 2026
Merged

chore: add cargo-deny + dependency-review + commitlint workflows #22

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
f389d3c
chore: add cargo-deny + dependency-review + commitlint workflows
satyakwok May 13, 2026
9d04017
fix(deny): ignore RUSTSEC-2024-0436 + RUSTSEC-2025-0134
satyakwok May 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions .commitlintrc.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
{
"extends": ["@commitlint/config-conventional"],
"rules": {
"header-max-length": [2, "always", 100],
"body-max-line-length": [0, "always"],
"footer-max-line-length": [0, "always"],
"type-enum": [2, "always", [
"build", "chore", "ci", "docs", "feat", "fix",
"perf", "refactor", "revert", "style", "test"
]]
}
}
26 changes: 26 additions & 0 deletions .github/workflows/cargo-deny.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,26 @@
name: cargo-deny

# License + advisory + ban policy enforcement via deny.toml. Runs on PR
# + push to main + manual dispatch. Mirrors the cargo-deny gate already
# running on the chain repo (sentrix-labs/sentrix).

on:
pull_request:
branches: [main]
push:
branches: [main]
workflow_dispatch:

permissions:
contents: read

jobs:
cargo-deny:
name: cargo-deny (licenses + advisories + bans)
runs-on: ubuntu-22.04
steps:
- uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
- uses: EmbarkStudios/cargo-deny-action@6c8f9facfa5047ec02d8485b6bf52b587b7777d1 # v2
with:
command: check
arguments: --all-features
22 changes: 22 additions & 0 deletions .github/workflows/commitlint.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,22 @@
name: commitlint

on:
pull_request:
branches: [main]

permissions:
contents: read
pull-requests: read

jobs:
commitlint:
name: commitlint
runs-on: ubuntu-22.04
steps:
- uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
with:
fetch-depth: 0

- uses: wagoid/commitlint-github-action@b948419dd99f3fd78a6548d48f94e3df7f6bf3ed # v6
with:
configFile: .commitlintrc.json
30 changes: 30 additions & 0 deletions .github/workflows/dependency-review.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,30 @@
name: Dependency review

# Runs GitHub's dependency-review-action on PRs. Diffs the lockfile
# changes vs the base branch and BLOCKS merge if newly-introduced
# dependencies have HIGH-severity vulnerabilities OR licenses outside
# our allowlist. Complements cargo-deny (full-tree post-merge gate)
# with a pre-merge diff-only gate.

on:
pull_request:
branches: [main]

permissions:
contents: read
pull-requests: write

jobs:
dependency-review:
name: Dependency review
runs-on: ubuntu-22.04
steps:
- uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5

- uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4
with:
fail-on-severity: high
# Mirror deny.toml [licenses].allow.
allow-licenses: MIT, Apache-2.0, Apache-2.0 WITH LLVM-exception, BSD-2-Clause, BSD-3-Clause, ISC, MPL-2.0, Unicode-DFS-2016, Unicode-3.0, CC0-1.0, Zlib, 0BSD, BUSL-1.1, CDLA-Permissive-2.0
allow-dependencies-licenses: pkg:githubactions/Swatinem/rust-cache
comment-summary-in-pr: on-failure
50 changes: 50 additions & 0 deletions deny.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,50 @@
# cargo-deny configuration. Loaded by .github/workflows/cargo-deny.yml.
# See https://embarkstudios.github.io/cargo-deny/

[graph]
all-features = true

[advisories]
yanked = "deny"
ignore = [
# `paste` is unmaintained (author archived) but still a transitive dep
# of alloy / sqlx / prost. No vulnerability — just dormant. Mirrors
# the ignore in indexer-rs + the chain repo.
"RUSTSEC-2024-0436",
# `rustls-pemfile` is deprecated in favour of `rustls-pki-types`;
# transitive via reqwest -> rustls. No vulnerability.
"RUSTSEC-2025-0134",
]

[licenses]
unused-allowed-license = "allow"
confidence-threshold = 0.8
allow = [
"MIT",
"Apache-2.0",
"Apache-2.0 WITH LLVM-exception",
"BSD-2-Clause",
"BSD-3-Clause",
"ISC",
"MPL-2.0",
"Unicode-DFS-2016",
"Unicode-3.0",
"CC0-1.0",
"Zlib",
"0BSD",
"BUSL-1.1",
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot May 13, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick | 🔵 Trivial

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Check if any dependencies use BUSL-1.1 license

cargo deny --all-features list 2>/dev/null | grep -i "busl\|business.source" || echo "No BUSL license found in dependency tree"

Repository: Sentriscloud/sdk-rs

Length of output: 104

Remove unused BUSL-1.1 license from the allowlist.

No dependencies in the tree use BUSL-1.1. While the configuration allows unused licenses without error, this entry in the allowlist serves no purpose and can be safely removed to keep the configuration clean.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@deny.toml` at line 35, Remove the unused "BUSL-1.1" entry from the license
allowlist by deleting the "BUSL-1.1" string from the allowlist array in
deny.toml (the entry shown as "BUSL-1.1",); ensure the allowlist remains valid
TOML (commas and quoting adjusted if necessary) after removal.

Copy link
Copy Markdown
Member Author

@satyakwok satyakwok May 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Skip — kept for forward-compat. sdk-rs is the SDK for Sentrix Chain whose workspace crates are all BUSL-1.1. If a future iteration adds a workspace path-dep on a chain crate (e.g. for shared types between server + client), the allowlist needs BUSL-1.1 already. Removing now and re-adding later = churn. Harmless idle entry.

Copy link
Copy Markdown

@coderabbitai coderabbitai Bot May 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@satyakwok, that's a clear rationale — keeping BUSL-1.1 as a forward-compat entry makes sense given that the chain workspace crates are already BUSL-1.1 licensed, and unused-allowed-license = "allow" means the idle entry is entirely harmless. I'll note this for future reviews.

✏️ Learnings added 
Learnt from: satyakwok
Repo: Sentriscloud/sdk-rs PR: 22
File: deny.toml:35-35
Timestamp: 2026-05-13T17:31:26.010Z
Learning: In `deny.toml` of the `sdk-rs` repository (Sentriscloud/sdk-rs), the `BUSL-1.1` entry in the `[licenses] allow` list is intentionally kept for forward-compatibility. `sdk-rs` is the SDK for Sentrix Chain, whose workspace crates are all BUSL-1.1 licensed. If a future iteration adds a path-dep on a chain crate (e.g. for shared types), the allowlist already covers it. The entry is harmless because `unused-allowed-license = "allow"` is set. Do not flag this as an unused/unnecessary entry.

Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure review instructions. You can manage existing learnings in the app.

# webpki-roots v1.x: CDLA-Permissive-2.0 (transitive via reqwest -> rustls).
"CDLA-Permissive-2.0",
]

[bans]
# Multiple major versions tolerated for now; tighten later.
multiple-versions = "warn"
wildcards = "warn"
allow-wildcard-paths = true
highlight = "all"
Comment on lines +40 to +45
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot May 13, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick | 🔵 Trivial

Consider tightening ban policies in future iterations.

The current configuration uses warn for multiple-versions and wildcards, which is reasonable for initial rollout. However, once baseline issues are resolved:

  • Consider changing multiple-versions = "deny" to prevent duplicate dependencies that increase binary size
  • Consider changing wildcards = "deny" to enforce explicit version pinning for reproducible builds

The allow-wildcard-paths = true setting is appropriate as it only affects local path dependencies.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@deny.toml` around lines 40 - 45, Update the deny.toml ban policy entries:
change the multiple-versions rule and the wildcards rule from "warn" to "deny"
when ready (i.e., set multiple-versions = "deny" and wildcards = "deny") to
prevent duplicate dependencies and enforce explicit version pinning, while
leaving allow-wildcard-paths = true as-is; ensure you run the dependency check
suite after making these changes to catch any violations and address them before
committing.

Copy link
Copy Markdown
Member Author

@satyakwok satyakwok May 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Skip for now — the comment itself frames this as "in future iterations after baseline issues are resolved". sdk-rs is at v0.1.0-alpha.0 with active migration churn (the sentrix-proto extraction lands in #23). Tightening multiple-versions/wildcards to deny right now would block legitimate transitive duplicates from alloy/leptos ecosystems mid-migration. Revisit at 1.0 stabilisation.

Copy link
Copy Markdown

@coderabbitai coderabbitai Bot May 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@satyakwok — Makes sense. The rationale is solid: locking down multiple-versions/wildcards to deny mid-migration with alloy/leptos in the graph would produce noisy violations that aren't actionable yet. Keeping warn now and revisiting at 1.0 stabilisation is the right call.

Would you like me to open a GitHub issue tagged as a 1.0 milestone task to track the eventual tightening of these ban policies? That way it doesn't fall through the cracks when the migration settles.


[sources]
unknown-registry = "deny"
unknown-git = "deny"
allow-git = []
Loading