ci(deps): fix red cargo-deny gate — run natively, drop stale license allow - #2
Merged
Conversation
…allow The `deny` job used the Docker-based EmbarkStudios/cargo-deny-action, which builds a container from a Docker Hub base image at runtime. Docker Hub pulls are rate-limited/flaky from GitHub Actions runners and the gate went red on a transient `registry-1.docker.io` i/o timeout, not on any cargo-deny finding. Root cause is the runtime Docker dependency, so remove it: install cargo-deny via taiki-e/install-action and run `cargo deny check` directly, mirroring the sibling `vet` job. Also drop the stale `Unicode-DFS-2016` license allowance (unicode-ident now ships under Unicode-3.0, already allowed) which was emitting an unmatched-allowance warning. `cargo deny check` is now warning-free. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The
denyCI job was RED. The failure is not a cargo-deny finding — it is a Docker Hub pull timeout inside the Docker-basedEmbarkStudios/cargo-deny-action:Docker Hub pulls are rate-limited/flaky from GitHub Actions runners. Locally
cargo deny checkis clean (advisories ok, bans ok, licenses ok, sources ok).Root-cause fix (not a suppression)
taiki-e/install-actionand runcargo deny checkdirectly, mirroring the siblingvetjob. No Docker Hub pull ⇒ gate no longer depends on external registry availability.Unicode-DFS-2016license allowance (unicode-ident now ships underUnicode-3.0, already allowed) that emitted an unmatched-allowance warning.Verified locally
cargo deny check→ warning-free:advisories ok, bans ok, licenses ok, sources okcargo fmt --checkclean ·cargo clippy --all-targets --all-featuresclean ·cargo test→ 79 passed🤖 Generated with Claude Code