deny.toml with the license allowlist (GPL-compatible; note that qp-rusty-crystals-threshold is GPL-3 if it is ever pulled in), advisories as errors, and a ban list for known-bad crates; cargo-machete for unused dependencies; --frozen for both lockfiles in CI. Add the tools to the runner image if missing.
Acceptance
A new RustSec advisory against a pinned dependency turns CI red within a day of publication.
Parent: #10
## Scope
`deny.toml` with the license allowlist (GPL-compatible; note that `qp-rusty-crystals-threshold` is GPL-3 if it is ever pulled in), advisories as errors, and a ban list for known-bad crates; `cargo-machete` for unused dependencies; `--frozen` for both lockfiles in CI. Add the tools to the runner image if missing.
## Acceptance
A new RustSec advisory against a pinned dependency turns CI red within a day of publication.
## Depends on
#12 (green CI).
grenade
added the child label 2026-09-15 12:42:02 +00:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Parent: #10
Scope
deny.tomlwith the license allowlist (GPL-compatible; note thatqp-rusty-crystals-thresholdis GPL-3 if it is ever pulled in), advisories as errors, and a ban list for known-bad crates;cargo-machetefor unused dependencies;--frozenfor both lockfiles in CI. Add the tools to the runner image if missing.Acceptance
A new RustSec advisory against a pinned dependency turns CI red within a day of publication.
Depends on
#12 (green CI).