From 5ef98856e4ecdef3053dd1011ae9e10310c029f3 Mon Sep 17 00:00:00 2001 From: Ahmed Din Date: Wed, 21 Oct 2026 03:31:22 +0500 Subject: [PATCH] chore(ci): add cargo-deny configuration for licenses and bans (#91) - Add deny.toml allowing Apache-2.0, MIT, and BSD licenses - Enforce check in .github/workflows/security.yml - Update CHANGELOG.md --- .github/workflows/security.yml | 9 +++++++++ CHANGELOG.md | 2 ++ deny.toml | 32 ++++++++++++++++++++++++++++++++ 3 files changed, 43 insertions(+) create mode 100644 deny.toml diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index d49d38b..1ef0b1a 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -60,3 +60,12 @@ jobs: steps: - uses: actions/checkout@v7 - uses: actions/dependency-review-action@v5 + + cargo-deny: + name: Cargo Deny (Licenses & Bans) + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v7 + - uses: EmbarkStudios/cargo-deny-action@v2 + with: + command: check licenses bans sources diff --git a/CHANGELOG.md b/CHANGELOG.md index 097b5dc..91023dd 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,6 +9,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Added +- `ci`: Add `deny.toml` and `cargo-deny` check in `.github/workflows/security.yml` to enforce license compliance (Apache-2.0, MIT, BSD) and deny unknown registries (#91). + - `rwa-asset`: holder count tracking (#146). `holder_count()` returns the number of addresses currently holding a strictly positive balance. The counter is incremented when a balance crosses 0 → >0 (first receive) and decremented when a balance hits exactly 0 (full burn or full send). `set_holder_cap(cap)` lets the admin set an optional ceiling on the holder count (Reg D style); any `mint`, `transfer`, `transfer_from` or `forced_transfer` that would add a new holder when the count already equals the cap is rejected with `ExceedsHolderCap` (error 25). `holder_count_cap()` returns the configured ceiling or `None`. The new `HolderCapSet` event is emitted by `set_holder_cap`, including when the cap is removed. A property test (`tests/test_holder_count.rs`) verifies the invariant `holder_count == count(addresses with balance > 0)` after every step in a 50-operation sequence of mints, burns, and transfers, both with and without an active cap. - `rwa-asset`: `set_governance`, `propose_cap_increase`/`approve_cap_increase`/`cancel_cap_increase` and `pending_cap_increase`. `update_metadata` still refuses to loosen a supply cap by itself (IR-02); raising one now requires the admin to propose a value and a separately configured `governance` address to approve it, mirroring `propose_admin`/`accept_admin`'s two-step shape. See [ADR-007](docs/architecture/007-governance-controlled-supply-cap.md) for why this is a second address rather than the `governance` contract itself (#148). diff --git a/deny.toml b/deny.toml new file mode 100644 index 0000000..0bafb02 --- /dev/null +++ b/deny.toml @@ -0,0 +1,32 @@ +# Configuration for cargo-deny (Issue #91) + +[graph] +targets = [] +all-features = false +no-default-features = false + +[licenses] +unlicensed = "deny" +allow = [ + "Apache-2.0", + "MIT", + "BSD-2-Clause", + "BSD-3-Clause", + "ISC", + "Unicode-DFS-2016", + "CC0-1.0", +] +confidence-threshold = 0.8 + +[licenses.private] +ignore = true + +[bans] +multiple-versions = "warn" +wildcards = "deny" +highlight = "all" + +[sources] +unknown-registries = "deny" +unknown-git = "deny" +allow-registry = ["https://github.com/rust-lang/crates.io-index"]