Repository navigation
Add cargo-deny configuration for licenses and bans #91
Description
Summary
Dependencies are audited for advisories but not for license compatibility.
Context
StellarForge is a Soroban workspace (contracts/*) plus a TypeScript SDK (sdk/). Phase 1 is feature complete, so this stage removes friction for new contributors and makes the toolchain trustworthy before more contracts land.
This issue belongs to Stage 1: Repository, Tooling and Developer Experience.
Objective
Deliver the change described above so that: cI fails when a GPL dependency is added.
Requirements
- Add
deny.tomlallowing Apache-2.0, MIT, BSD - Deny unknown registries
- Run
cargo deny checkinsecurity.yml
Out of Scope
Changes to contract behavior or SDK public APIs unless the issue says so.
Acceptance Criteria
- CI fails when a GPL dependency is added
- CI is green and a maintainer has reviewed the change
Definition of Done
- Findings, assumptions and residual risks are written down in
docs/ - The workflow runs green on a pull request and uses pinned action versions
- The pull request links this issue and updates
CHANGELOG.mdwhen behavior changes
References
- Phase 1 internal review
- Security notes
.github/workflows/
Activity
Miraclechukwuemeka commentedon Oct 15, 2026
@Miraclechukwuemeka has applied to work on this issue as part of the Stellar Wave Program's 10th wave.
ℹ️ Repo Maintainers: To accept this application, review their application or assign @Miraclechukwuemeka to this issue.
TheVictoriaAtteh commentedon Oct 15, 2026
@TheVictoriaAtteh has applied to work on this issue as part of the Stellar Wave Program's 10th wave.
ℹ️ Repo Maintainers: To accept this application, review their application or assign @TheVictoriaAtteh to this issue.
OrderStream commentedon Oct 15, 2026
@OrderStream has applied to work on this issue as part of the Stellar Wave Program's 10th wave.
ℹ️ Repo Maintainers: To accept this application, review their application or assign @OrderStream to this issue.
OrderStream commentedon Oct 20, 2026
Hi @maintainer, I have applied on Drips Wave 10 and implemented cargo-deny configuration and security workflow check in PR #635. Please assign this issue to @OrderStream on GitHub and Drips Wave 10, and merge the PR. Thank you!
OrderStream commentedon Oct 21, 2026
Hi @0xLizTech! PR #635 is ready for review with all CI checks passing.
Please assign @OrderStream prior to merging so Wave 10 points are credited:
👉 https://www.drips.network/wave/maintainers/issues/344ba27a-5c2f-488f-9a1b-419ea73099ea (or select @OrderStream under Assignees here on GitHub). Thank you!
noevidence1017 commentedon Oct 22, 2026
@noevidence1017 has applied to work on this issue as part of the Stellar Wave Program's 10th wave.
ℹ️ Repo Maintainers: To accept this application, review their application or assign @noevidence1017 to this issue.
drips-wave commentedon Oct 22, 2026
Congratulations, @noevidence1017! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on October 22, 2026.
🧑💻 @noevidence1017: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.
Warning
When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.
🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.
🌊 Happy Wave 🌊
chore(ci): add cargo-deny configuration for licenses and bans (#91)
Merge pull request #635 from OrderStream/feat/cargo-deny-91
drips-wave commentedon Oct 26, 2026
This issue has been completed by @noevidence1017 as part of the Stellar Wave Program's 10th Wave 🥳
😎 @noevidence1017: You earned 200 Points for completing this issue! Once the Wave's rewards are finalized, you'll be eligible for a percentage of the Wave's reward pool based on the percentage of total points you've earned. Learn more here. You can also Leave a review to share your experience working on this issue.
🧑💻 Repo maintainers: How'd the contributor do? Leave a review to share your experience working with them.
chore(ci): add cargo-deny, wasm size budgets, and soroban-sdk consist…