Skip to content

Commit aee4056

Browse files
lucarligcrivetimihai
lucarlig
and
crivetimihai
authored
chore: standardize cargo-deny coverage for rust projects (#3759)
* chore: standardize cargo-deny coverage for rust projects Signed-off-by: lucarlig <luca.carlig@ibm.com> * chore: add cargo-deny CI coverage for mcp_runtime Add cargo-deny policy checks (licenses, bans, sources) for tools_rust/mcp_runtime in the rust-tools workflow. Advisories are excluded as they have pre-existing failures tracked separately. Signed-off-by: Mihai Criveti <crivetimihai@gmail.com> * chore: trim license allowlist to actual usage and close CI gaps Reduce deny.toml allowlist from 107 licenses to 17 (14 actually used + 3 common safe buffer). Remove problematic licenses (JSON, CDDL, EPL, BSD-4-Clause, etc.) that were never needed. Add cargo-deny CI enforcement for mcp-servers/rust/fast-test-server and mcp-servers/rust/filesystem-server in the rust-tools workflow, closing the last CI coverage gap for deny.toml files. Signed-off-by: Mihai Criveti <crivetimihai@gmail.com> --------- Signed-off-by: lucarlig <luca.carlig@ibm.com> Signed-off-by: Mihai Criveti <crivetimihai@gmail.com> Co-authored-by: Mihai Criveti <crivetimihai@gmail.com>
1 parent 43d9702 commit aee4056

13 files changed

Lines changed: 226 additions & 19 deletions

File tree

‎.github/workflows/rust-plugins.yml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -121,9 +121,16 @@ jobs:
121121
- name: Install cargo-audit
122122
run: cargo install cargo-audit
123123

124+
- name: Install cargo-deny
125+
run: cargo install cargo-deny
126+
124127
- name: Run security audit on all plugins
125128
run: make rust-audit
126129

130+
# cargo-audit covers advisories separately; cargo-deny here enforces policy and licensing.
131+
- name: Run cargo-deny policy checks on all plugins
132+
run: make rust-deny
133+
127134
# Benchmark tests (verify benchmarks compile and run)
128135
benchmark-tests:
129136
if: github.event_name != 'pull_request' || !github.event.pull_request.draft

‎.github/workflows/rust-tools.yml‎

Lines changed: 17 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,12 +5,14 @@ on:
55
branches: [main, develop]
66
paths:
77
- "tools_rust/**"
8+
- "mcp-servers/rust/**"
89
- ".github/workflows/rust-tools.yml"
910
pull_request:
1011
types: [opened, synchronize, ready_for_review]
1112
branches: [main, develop, rust-tools-ci]
1213
paths:
1314
- "tools_rust/**"
15+
- "mcp-servers/rust/**"
1416
workflow_dispatch:
1517

1618
env:
@@ -85,9 +87,22 @@ jobs:
8587
- name: Install cargo-deny
8688
run: cargo install cargo-deny
8789

88-
- name: Run license check
90+
- name: Run cargo-deny policy checks (wrapper)
8991
working-directory: tools_rust/wrapper
90-
run: make licenses
92+
run: make deny
93+
94+
# Exclude advisories: pre-existing advisory issues tracked separately.
95+
- name: Run cargo-deny policy checks (mcp_runtime)
96+
working-directory: tools_rust/mcp_runtime
97+
run: cargo deny check licenses bans sources
98+
99+
- name: Run cargo-deny policy checks (fast-test-server)
100+
working-directory: mcp-servers/rust/fast-test-server
101+
run: cargo deny check licenses bans sources
102+
103+
- name: Run cargo-deny policy checks (filesystem-server)
104+
working-directory: mcp-servers/rust/filesystem-server
105+
run: cargo deny check licenses bans sources
91106

92107
coverage:
93108
if: github.event_name != 'pull_request' || !github.event.pull_request.draft

‎Makefile‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8167,6 +8167,9 @@ rust-build-wheels: rust-ensure-deps ## Build Python wheels for all Rust plug
81678167
rust-audit: rust-ensure-deps ## Run security audit on all Rust plugins
81688168
@$(MAKE) -C plugins_rust audit
81698169

8170+
rust-deny: rust-ensure-deps ## Run cargo-deny policy checks on all Rust plugins
8171+
@$(MAKE) -C plugins_rust deny
8172+
81708173
rust-coverage: rust-ensure-deps ## Run coverage for all Rust plugins
81718174
@$(MAKE) -C plugins_rust coverage
81728175

‎mcp-servers/rust/fast-test-server/deny.toml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# Cargo-deny config: license and policy checks for this crate.
2+
# See https://embarkstudios.github.io/cargo-deny/
3+
4+
[licenses]
5+
unused-allowed-license = "allow"
6+
confidence-threshold = 0.95
7+
allow = [
8+
# Currently used across our Rust projects
9+
"Apache-2.0",
10+
"BSD-2-Clause",
11+
"BSD-3-Clause",
12+
"BSL-1.0",
13+
"CC0-1.0",
14+
"ISC",
15+
"LGPL-2.1-or-later",
16+
"MIT",
17+
"MIT-0",
18+
"OpenSSL",
19+
"Unicode-3.0",
20+
"Unicode-DFS-2016",
21+
"Unlicense",
22+
"Zlib",
23+
# Common safe licenses in the Rust ecosystem
24+
"0BSD",
25+
"Apache-2.0 WITH LLVM-exception",
26+
"Unicode-DFS-2015",
27+
]

‎mcp-servers/rust/filesystem-server/Cargo.toml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ name = "filesystem-server"
33
version = "0.1.0"
44
edition = "2024"
55
authors = ["Matheus Cafalchio"]
6+
license = "Apache-2.0"
67

78

89
[dependencies]

‎mcp-servers/rust/filesystem-server/deny.toml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# Cargo-deny config: license and policy checks for this crate.
2+
# See https://embarkstudios.github.io/cargo-deny/
3+
4+
[licenses]
5+
unused-allowed-license = "allow"
6+
confidence-threshold = 0.95
7+
allow = [
8+
# Currently used across our Rust projects
9+
"Apache-2.0",
10+
"BSD-2-Clause",
11+
"BSD-3-Clause",
12+
"BSL-1.0",
13+
"CC0-1.0",
14+
"ISC",
15+
"LGPL-2.1-or-later",
16+
"MIT",
17+
"MIT-0",
18+
"OpenSSL",
19+
"Unicode-3.0",
20+
"Unicode-DFS-2016",
21+
"Unlicense",
22+
"Zlib",
23+
# Common safe licenses in the Rust ecosystem
24+
"0BSD",
25+
"Apache-2.0 WITH LLVM-exception",
26+
"Unicode-DFS-2015",
27+
]

‎plugins_rust/Makefile‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
# Makefile for Rust Plugins
22
# Automatically discovers and installs all plugins (subdirectories with Cargo.toml)
33

4-
.PHONY: install clean list help build test fmt clippy doc test-python test-verbose clean-all fmt-check doc-open bench bench-compare compare check verify verify-stubs clean-stubs test-integration test-all uninstall
4+
.PHONY: install clean list help build test fmt clippy doc test-python test-verbose clean-all fmt-check doc-open bench bench-compare compare check verify verify-stubs clean-stubs test-integration test-all uninstall deny
55

66
# Discover all plugin directories containing Cargo.toml
77
PLUGIN_DIRS := $(shell find . -mindepth 1 -maxdepth 1 -type d -exec test -f {}/Cargo.toml \; -print | sed 's|^\./||' | sort)
@@ -162,6 +162,14 @@ audit:
162162
done
163163
@echo "✓ All plugins audited successfully"
164164

165+
deny:
166+
@echo "Running cargo-deny policy checks for all Rust plugins..."
167+
@for plugin in $(PLUGIN_DIRS); do \
168+
echo "Checking dependency policy: $$plugin"; \
169+
(cd $$plugin && cargo deny check licenses bans sources) || exit 1; \
170+
done
171+
@echo "✓ All plugins passed cargo-deny"
172+
165173
coverage:
166174
@echo "Running coverage for all Rust plugins..."
167175
@for plugin in $(PLUGIN_DIRS); do \

‎plugins_rust/encoded_exfil_detection/deny.toml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# Cargo-deny config: license and policy checks for this crate.
2+
# See https://embarkstudios.github.io/cargo-deny/
3+
4+
[licenses]
5+
unused-allowed-license = "allow"
6+
confidence-threshold = 0.95
7+
allow = [
8+
# Currently used across our Rust projects
9+
"Apache-2.0",
10+
"BSD-2-Clause",
11+
"BSD-3-Clause",
12+
"BSL-1.0",
13+
"CC0-1.0",
14+
"ISC",
15+
"LGPL-2.1-or-later",
16+
"MIT",
17+
"MIT-0",
18+
"OpenSSL",
19+
"Unicode-3.0",
20+
"Unicode-DFS-2016",
21+
"Unlicense",
22+
"Zlib",
23+
# Common safe licenses in the Rust ecosystem
24+
"0BSD",
25+
"Apache-2.0 WITH LLVM-exception",
26+
"Unicode-DFS-2015",
27+
]

‎plugins_rust/pii_filter/deny.toml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# Cargo-deny config: license and policy checks for this crate.
2+
# See https://embarkstudios.github.io/cargo-deny/
3+
4+
[licenses]
5+
unused-allowed-license = "allow"
6+
confidence-threshold = 0.95
7+
allow = [
8+
# Currently used across our Rust projects
9+
"Apache-2.0",
10+
"BSD-2-Clause",
11+
"BSD-3-Clause",
12+
"BSL-1.0",
13+
"CC0-1.0",
14+
"ISC",
15+
"LGPL-2.1-or-later",
16+
"MIT",
17+
"MIT-0",
18+
"OpenSSL",
19+
"Unicode-3.0",
20+
"Unicode-DFS-2016",
21+
"Unlicense",
22+
"Zlib",
23+
# Common safe licenses in the Rust ecosystem
24+
"0BSD",
25+
"Apache-2.0 WITH LLVM-exception",
26+
"Unicode-DFS-2015",
27+
]

‎plugins_rust/secrets_detection/deny.toml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# Cargo-deny config: license and policy checks for this crate.
2+
# See https://embarkstudios.github.io/cargo-deny/
3+
4+
[licenses]
5+
unused-allowed-license = "allow"
6+
confidence-threshold = 0.95
7+
allow = [
8+
# Currently used across our Rust projects
9+
"Apache-2.0",
10+
"BSD-2-Clause",
11+
"BSD-3-Clause",
12+
"BSL-1.0",
13+
"CC0-1.0",
14+
"ISC",
15+
"LGPL-2.1-or-later",
16+
"MIT",
17+
"MIT-0",
18+
"OpenSSL",
19+
"Unicode-3.0",
20+
"Unicode-DFS-2016",
21+
"Unlicense",
22+
"Zlib",
23+
# Common safe licenses in the Rust ecosystem
24+
"0BSD",
25+
"Apache-2.0 WITH LLVM-exception",
26+
"Unicode-DFS-2015",
27+
]

0 commit comments

Comments
 (0)