From 63a1f76d9d51026937fbbf31ba4e5ff6d4922241 Mon Sep 17 00:00:00 2001 From: Albert Hui Date: Mon, 27 Jul 2026 01:47:59 +0800 Subject: [PATCH] =?UTF-8?q?ci(deps):=20fix=20red=20cargo-deny=20gate=20?= =?UTF-8?q?=E2=80=94=20run=20natively,=20drop=20stale=20license=20allow?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The `deny` job used the Docker-based EmbarkStudios/cargo-deny-action, which builds a container from a Docker Hub base image at runtime. Docker Hub pulls are rate-limited/flaky from GitHub Actions runners and the gate went red on a transient `registry-1.docker.io` i/o timeout, not on any cargo-deny finding. Root cause is the runtime Docker dependency, so remove it: install cargo-deny via taiki-e/install-action and run `cargo deny check` directly, mirroring the sibling `vet` job. Also drop the stale `Unicode-DFS-2016` license allowance (unicode-ident now ships under Unicode-3.0, already allowed) which was emitting an unmatched-allowance warning. `cargo deny check` is now warning-free. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/ci.yml | 15 +++++++++++++-- deny.toml | 1 - 2 files changed, 13 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index c3f6418..2e66b4d 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -58,10 +58,21 @@ jobs: - run: cargo fmt --check deny: + name: Cargo Deny (advisories/licenses/bans/sources) runs-on: ubuntu-latest + # Native install rather than the Docker-based cargo-deny-action: the action + # builds a container from a Docker Hub base image at runtime, which is rate- + # limited/flaky from GitHub Actions and made this gate red on a transient + # registry timeout. Mirrors the `vet` job below (taiki-e/install-action). steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 - - uses: EmbarkStudios/cargo-deny-action@3fd3802e88374d3fe9159b834c7714ec57d6c979 # v2 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + - uses: dtolnay/rust-toolchain@stable + - name: Install cargo-deny + uses: taiki-e/install-action@59012be0884e296ca2da49b530610e72c49039ad # v2.81.6 + with: + tool: cargo-deny + - name: Check dependency hygiene + run: cargo deny check vet: name: Cargo Vet (supply-chain) diff --git a/deny.toml b/deny.toml index b4aa2a0..e0210ba 100644 --- a/deny.toml +++ b/deny.toml @@ -7,7 +7,6 @@ allow = [ "MIT", "Apache-2.0", "Unicode-3.0", - "Unicode-DFS-2016", ] confidence-threshold = 0.8