From 44d32b44324c20a2b7aff0acebcf07fc26068e52 Mon Sep 17 00:00:00 2001
From: rob thijssen <grenade@rob.tn>
Date: Wed, 16 Sep 2026 14:24:03 +0300
Subject: [PATCH] ci: the dependency policy in the gate, and a daily advisory
 check

The rust gate builds and tests with --locked, so a change that would
move Cargo.lock fails instead of resolving something new. A dependency
policy step runs cargo deny check (licenses, advisories, bans, sources
from deny.toml) and cargo machete, both now in the runner image
(gongfoo bd936d3, images run 284). deps.yaml runs the advisory check
daily on the rust runner, so an advisory published against a
dependency the lockfile already pins turns red within a day whether or
not anyone pushes.

Closes #49

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014ftBXYuba8ARhQeF74oUgW
---
 .gitea/workflows/ci.yaml   | 17 +++++++++++++++--
 .gitea/workflows/deps.yaml | 25 +++++++++++++++++++++++++
 2 files changed, 40 insertions(+), 2 deletions(-)
 create mode 100644 .gitea/workflows/deps.yaml

diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index bb2a270..decdf41 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -35,11 +35,24 @@ jobs:
           pnpm build
 
       - name: rust gate
+        # --locked: a build that would change Cargo.lock fails rather than
+        # quietly resolving something new (#49).
         run: |
           set -euo pipefail
           cargo fmt --check --all
-          cargo clippy --workspace --all-targets -- -D warnings
-          cargo test --workspace
+          cargo clippy --locked --workspace --all-targets -- -D warnings
+          cargo test --locked --workspace
+
+      - name: dependency policy
+        # deny.toml: licenses, advisories, bans and sources; machete: crates
+        # declared and never used. Both ship in the runner image (gongfoo
+        # runner-rust). The daily run in deps.yaml catches an advisory
+        # published against an unchanged lockfile (#49).
+        run: |
+          set -euo pipefail
+          cargo deny --version
+          cargo deny check
+          cargo machete
 
       - name: rust talks to the webview through one file
         # `ui/src/api/wallet.ts` is the only module allowed to import Tauri's
diff --git a/.gitea/workflows/deps.yaml b/.gitea/workflows/deps.yaml
new file mode 100644
index 0000000..393536f
--- /dev/null
+++ b/.gitea/workflows/deps.yaml
@@ -0,0 +1,25 @@
+name: deps
+
+# The advisory half of the dependency policy on a clock (#49). CI runs the
+# full policy on every push; this runs the advisory check daily, so a
+# RustSec advisory published against a dependency this repository already
+# pins turns red within a day even when nobody pushes.
+
+on:
+  schedule:
+    - cron: "17 5 * * *"
+  workflow_dispatch:
+
+jobs:
+  advisories:
+    # `rust`: cargo-deny ships in the image; no GTK is needed to read a
+    # lockfile against the advisory database.
+    runs-on: rust
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: advisories against the pinned lockfile
+        run: |
+          set -euo pipefail
+          cargo deny --version
+          cargo deny check advisories