dependency policy in ci: cargo-deny, cargo-machete, frozen lockfiles #49

New Issue

grenade · 2026-09-15T12:41:15Z

grenade commented

2026-09-15 12:41:15 +00:00

Parent: #10

Scope

deny.toml with the license allowlist (GPL-compatible; note that qp-rusty-crystals-threshold is GPL-3 if it is ever pulled in), advisories as errors, and a ban list for known-bad crates; cargo-machete for unused dependencies; --frozen for both lockfiles in CI. Add the tools to the runner image if missing.

Acceptance

A new RustSec advisory against a pinned dependency turns CI red within a day of publication.

Depends on

#12 (green CI).

Parent: #10 ## Scope `deny.toml` with the license allowlist (GPL-compatible; note that `qp-rusty-crystals-threshold` is GPL-3 if it is ever pulled in), advisories as errors, and a ban list for known-bad crates; `cargo-machete` for unused dependencies; `--frozen` for both lockfiles in CI. Add the tools to the runner image if missing. ## Acceptance A new RustSec advisory against a pinned dependency turns CI red within a day of publication. ## Depends on #12 (green CI).

grenade added the child label 2026-09-15 12:42:02 +00:00

grenade referenced this issue

2026-09-15 12:42:48 +00:00

epic: security hardening and release readiness #10

grenade referenced this issue from a commit

2026-09-16 06:22:47 +00:00

build: a dependency policy: cargo-deny, cargo-machete, and the advisories it found

grenade referenced this issue from a commit

2026-09-16 06:23:20 +00:00

fix(substrate): the lints Rust 1.88 turned on

grenade referenced this issue from a commit

2026-09-16 11:24:10 +00:00