CI: valid YAML, pinned actions, fmt, cargo deny and npm audit

The old workflow was invalid YAML (unquoted ${{ }} in a flow mapping) and never ran. deny.toml: allows BSL-1.0 (arboard's Windows deps) and CDLA-Permissive-2.0 (webpki-roots); ignores three unmaintained-crate notices for build-time proc-macros (uniffi 0.28, glib-macros 0.18) that need upstream upgrades. Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-10-17 00:53:36 +09:00
parent 21ff829405
commit 62f2dc3dca
2 changed files with 98 additions and 15 deletions
@@ -0,0 +1,31 @@
+# cargo deny check — enforces docs/06 §5 (no GPL in shipped apps) and advisories. Mirrors kestrove-core/deny.toml.
+# Not run by `npm audit`: covers only the Rust side (src-tauri).
+[advisories]
+version = 2
+yanked = "deny"
+ignore = [
+  # Unmaintained notices (no known vulnerability) for build-time proc-macro crates we can't replace
+  # without upgrading upstream: uniffi 0.28 (through kv-ffi) and gtk-rs glib-macros 0.18 (Tauri on Linux).
+  { id = "RUSTSEC-2025-0141", reason = "bincode 1.x via uniffi_macros 0.28 (build-time)" },
+  { id = "RUSTSEC-2024-0436", reason = "paste via uniffi 0.28 (proc-macro)" },
+  { id = "RUSTSEC-2024-0370", reason = "proc-macro-error via glib-macros 0.18 / Tauri gtk stack (proc-macro)" },
+]
+
+[licenses]
+version = 2
+allow = ["MIT", "Apache-2.0", "Apache-2.0 WITH LLVM-exception", "BSD-2-Clause", "BSD-3-Clause", "ISC", "Unicode-3.0", "Unicode-DFS-2016", "Zlib", "CC0-1.0", "MPL-2.0",
+  # clipboard-win / error-code (arboard on Windows): Boost Software License, permissive.
+  "BSL-1.0",
+  # webpki-roots (Mozilla's CA bundle, via kv-ffi's TLS): permissive data license.
+  "CDLA-Permissive-2.0"]
+confidence-threshold = 0.9
+
+[bans]
+multiple-versions = "warn"
+wildcards = "deny"
+# kv-ffi is a path dependency on ../../kestrove-core without a version; this crate is never published.
+allow-wildcard-paths = true
+
+[sources]
+unknown-registry = "deny"
+unknown-git = "deny"