ci: exempt the rust-cache action from the copyleft deny-list - #82
Merged
Conversation
dependency-review denies copyleft licences because a crate compiled into the binary we distribute must not carry them. Swatinem/rust-cache is LGPL-3.0 and was tripping that list, blocking its own version bumps. The list is aimed at the wrong thing here. A GitHub Action runs on the runner, saves and restores ~/.cargo and target/, and is never linked, vendored or conveyed, so its copyleft cannot reach an artifact we ship. release.yml -- which builds the tarballs and publishes to crates.io -- does not use it at all; only ci.yml does. Nothing changes in substance: the same LGPL-3.0 code is already pinned on main. dependency-review only inspects CHANGED dependencies, so the existing pin was never looked at and only a bump makes it fail. Without this exemption every future rust-cache bump fails identically and Dependabot reopens it forever. deny.toml stays the sole authority for crates and is deliberately not relaxed. The exemption names one action rather than pkg:githubactions/*, so a new copyleft action still trips the check and gets a decision. Unblocks #80
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Unblocks #80, which Dependabot cannot merge today: bumping
Swatinem/rust-cachetrips our owndeny-licenseslist on LGPL-3.0.Why the check is misfiring
The deny-list's stated purpose is that this is a permissive Apache-2.0
project, so copyleft dependencies compiled into the binary we
distribute are rejected. That is exactly right for crates — and
deny.tomlenforces it against the real crate graph, untouched by this PR.A GitHub Action is not that.
rust-cacheruns on the runner, saves andrestores
~/.cargoandtarget/, and is never linked, vendored, orconveyed. Its copyleft cannot reach anything we ship — the same reason
proprietary software may be compiled with GCC.
release.yml, which buildsthe release tarballs and publishes to crates.io, does not use it at all;
all five occurrences are in
ci.yml.This changes nothing in substance
The identical LGPL-3.0 code is already pinned on
main(e18b4977—verified same licence as the proposed SHA).
dependency-reviewonlyinspects changed dependencies, so the existing pin was never examined;
only a bump makes it look. Without this exemption every future
rust-cachebump fails the same way and Dependabot reopens it forever.Scope
deny.tomluntouched — crates keep the full copyleft policy.deny-licensesuntouched — all 15 entries remain,LGPL-3.0-onlyincluded.
pkg:githubactions/*, so a new copyleftaction still trips the check and gets a deliberate decision rather than
a blanket pass.
The reasoning is recorded in a comment beside the exemption, since the two
policies now differ by one entry and a future reader would otherwise read
that as drift from
deny.toml.