From 4543d7083a9d9643ff79d1909e89ed21e09781f3 Mon Sep 17 00:00:00 2001 From: Adam Poulemanos Date: Sun, 26 Jul 2026 09:44:04 -0400 Subject: [PATCH] ci: run all four cargo-deny checks, not just advisories MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The hk `cargo_deny` step ran `check advisories`, so `deny.toml`'s licenses, bans and sources policy was configured but never enforced by any hook or CI job — the same shape as a green check that runs nothing. `check` with no subcommand runs all four. Also drops `-A unsound -A unmaintained -A yanked -A notice`. They suppress nothing in the current graph, so their only effect would be to hide a future unmaintained or yanked dependency. RUSTSEC-2024-0364 is still handled by ID in deny.toml's `ignore`, where the reason is written down. The glob widens from Cargo.lock to Cargo.lock/Cargo.toml/deny.toml: licenses and bans read Cargo.toml and all four read deny.toml, so editing the policy itself has to re-run the step that enforces it. Verified: full check is clean on main, and fails `licenses FAILED` when MIT is dropped from the allow list — a violation the previous command reported as `advisories ok`, exit 0. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01XocU6NjgZricrRWMLyLXDn --- hk.pkl | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/hk.pkl b/hk.pkl index aeed609..b1cee16 100644 --- a/hk.pkl +++ b/hk.pkl @@ -11,13 +11,23 @@ local linters = new Mapping { ["cargo_deny"] = new Step { workspace_indicator = "Cargo.toml" - glob = "Cargo.lock" - // Gate on vulnerabilities only, letting cargo-deny's own exit code decide. + // All three inputs matter now that every check runs: `licenses` and `bans` + // read Cargo.toml, and all four read deny.toml. With only Cargo.lock here, + // editing the policy itself would not re-run the step that enforces it. + glob = List("Cargo.lock", "Cargo.toml", "deny.toml") + // `check` with no subcommand runs all four — advisories, bans, licenses, + // sources — letting cargo-deny's own exit code decide. This was + // `check advisories` with `-A unsound -A unmaintained -A yanked -A notice`, + // which meant `deny.toml`'s licenses/bans/sources policy was configured but + // never enforced by any hook or CI job. The four allowances are gone too: + // they suppress nothing in the current graph, so keeping them would only + // hide a *future* unmaintained or yanked dependency. If one lands, add it to + // `ignore` in deny.toml with a reason rather than reinstating a blanket -A. // (The previous `-f json ... | jq -e '.[].vulnerabilities | length == 0'` // pipeline no longer parses: with `-f json` cargo-deny streams one object // per diagnostic, not an array, so jq failed with exit 5 on every run.) // --exclude-dev is a top-level flag; it moved off the `check` subcommand. - check = "cargo deny --all-features --manifest-path {{ workspace_indicator }} --exclude-dev -L warn check advisories --hide-inclusion-graph -A unsound -A unmaintained -A yanked -A notice" + check = "cargo deny --all-features --manifest-path {{ workspace_indicator }} --exclude-dev -L warn check --hide-inclusion-graph" } ["cargo_fmt"] = Builtins.cargo_fmt ["cargo_clippy"] = Builtins.cargo_clippy