meta: set up cargo-deny for dependency audits

Signed-off-by: NotAShelf <raf@notashelf.dev>
Change-Id: Ie08db7030742f7278a1256282586a5526a6a6964

Author: NotAShelf

.deny.toml

@@ -0,0 +1,62 @@
+[advisories]
+ignore = [  ]
+
+[licenses]
+allow = [
+  "0BSD",
+  "Apache-2.0",
+  "Apache-2.0 WITH LLVM-exception",
+  "BSD-1-Clause",
+  "BSD-2-Clause",
+  "BSD-3-Clause",
+  "BSL-1.0",
+  "CC0-1.0",
+  "CDLA-Permissive-2.0",
+  "ISC",
+  "MIT",
+  "MIT-0",
+  "MPL-2.0",
+  "Unicode-3.0",
+  "Unlicense",
+  "Zlib",
+]
+confidence-threshold = 0.8
+
+exceptions = [
+  { allow = [
+    "EUPL-1.2",
+  ], crate = "evix" },
+  { allow = [
+    "EUPL-1.2",
+  ], crate = "pound" },
+  { allow = [
+    "EUPL-1.2",
+  ], crate = "pound-derive" },
+]
+
+[licenses.private]
+ignore     = false
+registries = [  ]
+
+[bans]
+allow                      = [  ]
+allow-workspace            = true
+deny                       = [  ]
+external-default-features  = "allow"
+highlight                  = "all"
+multiple-versions          = "warn"
+skip                       = [  ]
+skip-tree                  = [  ]
+wildcards                  = "deny"
+workspace-default-features = "allow"
+
+[sources]
+allow-git        = [  ]
+allow-registry   = [ "https://github.com/rust-lang/crates.io-index" ]
+unknown-git      = "deny"
+unknown-registry = "deny"
+
+[sources.allow-org]
+bitbucket = [  ]
+github    = [  ]
+gitlab    = [  ]

.github/workflows/rust.yml

@@ -38,6 +38,19 @@ jobs:
       - name: Run Clippy
         run: nix develop --command cargo clippy --all-targets -- -D warnings
 
+  deny:
+    name: Dependency Audit
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9f698171ed81b15d1823a05fc7211befd50c8ae0 # v6.0.3
+        with:
+          persist-credentials: false
+      - uses: cachix/install-nix-action@b97f05dcb019ddea06450a50ef6203d2fdc19fee # v31
+      - name: Check Dependency Policy
+        run: nix build .#checks.x86_64-linux.cargo-deny --no-link -L
+      - name: Audit Dependency Advisories
+        run: nix develop --command cargo deny check advisories
+
   test:
     name: Test
     runs-on: ubuntu-latest

flake.nix

@@ -122,6 +122,20 @@
 
     checks = forAllSystems (system: let
       pkgs = pkgsFor system;
+      craneLib = crane.mkLib pkgs;
+      cargoDenySrc = let
+        fs = lib.fileset;
+        s = ./.;
+      in
+        fs.toSource {
+          root = s;
+          fileset = fs.unions [
+            (s + /crates)
+            (s + /Cargo.lock)
+            (s + /Cargo.toml)
+            (s + /deny.toml)
+          ];
+        };
 
       callTest = path: pkgs.callPackage path {inherit self;};
       nixosModuleAgentPackage = pkgs.callPackage ./nix/package.nix {crate = "circus-agent";};
@@ -153,6 +167,13 @@
           paths = builtins.attrValues vmTests;
         };
 
+        cargo-deny = craneLib.cargoDeny {
+          pname = "circus";
+          src = cargoDenySrc;
+          cargoDenyChecks = "bans licenses sources";
+          cargoExtraArgs = "--locked";
+        };
+
         formatting =
           pkgs.runCommand "circus-formatting-check" {
             preferLocal = true;
@@ -188,6 +209,7 @@
           glibc.dev
 
           taplo
+          cargo-deny
           cargo-nextest
           clippy
           rust-analyzer