From d735a7034dbc29c6fd6c36dbe83809fb44dbb104 Mon Sep 17 00:00:00 2001 From: Martin Pluskal Date: Tue, 11 Aug 2026 20:08:01 +0200 Subject: [PATCH] ci: exempt the rust-cache action from the copyleft deny-list dependency-review denies copyleft licences because a crate compiled into the binary we distribute must not carry them. Swatinem/rust-cache is LGPL-3.0 and was tripping that list, blocking its own version bumps. The list is aimed at the wrong thing here. A GitHub Action runs on the runner, saves and restores ~/.cargo and target/, and is never linked, vendored or conveyed, so its copyleft cannot reach an artifact we ship. release.yml -- which builds the tarballs and publishes to crates.io -- does not use it at all; only ci.yml does. Nothing changes in substance: the same LGPL-3.0 code is already pinned on main. dependency-review only inspects CHANGED dependencies, so the existing pin was never looked at and only a bump makes it fail. Without this exemption every future rust-cache bump fails identically and Dependabot reopens it forever. deny.toml stays the sole authority for crates and is deliberately not relaxed. The exemption names one action rather than pkg:githubactions/*, so a new copyleft action still trips the check and gets a decision. Unblocks #80 --- .github/workflows/dependency-review.yml | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml index 24ff433..f94d64d 100644 --- a/.github/workflows/dependency-review.yml +++ b/.github/workflows/dependency-review.yml @@ -49,3 +49,20 @@ jobs: EPL-2.0, MPL-1.1, OSL-3.0 + # Swatinem/rust-cache is LGPL-3.0 and exempt from the list above, + # which exists for dependencies that get COMPILED INTO the binary + # we distribute. This is a GitHub Action: it runs on the runner, + # saves and restores ~/.cargo and target/, is never linked, never + # vendored, and never conveyed — so its copyleft cannot reach an + # artifact we ship. release.yml, which builds the tarballs and + # publishes to crates.io, does not use it at all; only ci.yml does. + # The exemption changes nothing in substance: the same LGPL-3.0 + # code is already pinned on main, and only a version bump makes + # dependency-review look at it (it inspects CHANGED dependencies), + # so without this every future bump fails identically. + # deny.toml remains the sole authority for crates, where copyleft + # would be a real distribution problem — it is deliberately NOT + # relaxed here. Exempt one action, not `pkg:githubactions/*`, so a + # new copyleft action still trips the check and gets a decision. + allow-dependencies-licenses: >- + pkg:githubactions/Swatinem/rust-cache