ci: add cargo-deny config, fix workspace license by KooshaPari · Pull Request #3 · KooshaPari/forgecode

KooshaPari · 2026-05-02T03:06:10Z

User description

Summary

Bootstrap deny.toml with license allowlist + advisory ignores
Add license = MIT to workspace.package (was missing)
Add license.workspace = true to all 27 crate manifests
Add cargo-deny.yml CI workflow
Ignore transitive unmaintained (bincode, yaml-rust, paste, rustls-pemfile)
Ignore transitive vulns (hickory-proto, rustls-webpki) via aws-sdk/reqwest

Test plan

cargo deny check passes locally (advisories ok, licenses ok, bans ok, sources ok)

🤖 Generated with Claude Code

Note

Low Risk
Low risk: changes are limited to CI policy enforcement and Cargo manifest metadata, with no runtime code or dependency behavior changes.

Overview
Adds cargo-deny enforcement to CI via a new GitHub Actions workflow that runs cargo deny check on pushes/PRs to main.

Introduces a repo-wide deny.toml (license allowlist + RustSec advisory ignore list) and standardizes licensing by setting license = "MIT" at the workspace level and inheriting it across all crate manifests via license.workspace = true.

^{Reviewed by Cursor Bugbot for commit ca2a7f8. Bugbot is set up for automated code reviews on this repo. Configure here.}

CodeAnt-AI Description

Add Cargo Deny checks and standardize workspace licensing

What Changed

CI now runs Cargo Deny on pushes and pull requests to main, so license and advisory issues are caught before merge
The workspace now declares an MIT license once at the top level, and all crates inherit it instead of repeating it individually
A new deny list allows the project's approved licenses and ignores known transitive advisories and unmaintained dependencies

Impact

✅ Earlier detection of license problems
✅ Fewer merge-time security policy failures
✅ Consistent license metadata across crates

🔄 Retrigger CodeAnt AI Review

Details

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

- Bootstrap deny.toml with license allowlist + advisory ignores - Add license = MIT to workspace.package (was missing) - Add license.workspace = true to all 27 crate manifests - Ignore transitive unmaintained (bincode, yaml-rust, paste, rustls-pemfile) - Ignore transitive vulns (hickory-proto, rustls-webpki) via aws-sdk/reqwest Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

gemini-code-assist · 2026-05-02T03:06:13Z

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

codeant-ai · 2026-05-02T03:06:14Z

CodeAnt AI is reviewing your PR.

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

coderabbitai · 2026-05-02T03:06:16Z

Warning

Rate limit exceeded

@KooshaPari has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 32 minutes and 51 seconds before requesting another review.

To keep reviews running without waiting, you can enable usage-based add-on for your organization. This allows additional reviews beyond the hourly cap. Account admins can enable it under billing.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: bdd22f40-6d33-4ab9-8a45-b57b68f554a3

📥 Commits

Reviewing files that changed from the base of the PR and between 0321464 and ca2a7f8.

📒 Files selected for processing (28)

.github/workflows/cargo-deny.yml
Cargo.toml
crates/forge_api/Cargo.toml
crates/forge_app/Cargo.toml
crates/forge_ci/Cargo.toml
crates/forge_config/Cargo.toml
crates/forge_display/Cargo.toml
crates/forge_domain/Cargo.toml
crates/forge_embed/Cargo.toml
crates/forge_eventsource/Cargo.toml
crates/forge_eventsource_stream/Cargo.toml
crates/forge_fs/Cargo.toml
crates/forge_infra/Cargo.toml
crates/forge_json_repair/Cargo.toml
crates/forge_main/Cargo.toml
crates/forge_markdown_stream/Cargo.toml
crates/forge_repo/Cargo.toml
crates/forge_select/Cargo.toml
crates/forge_services/Cargo.toml
crates/forge_snaps/Cargo.toml
crates/forge_spinner/Cargo.toml
crates/forge_stream/Cargo.toml
crates/forge_template/Cargo.toml
crates/forge_test_kit/Cargo.toml
crates/forge_tool_macros/Cargo.toml
crates/forge_tracker/Cargo.toml
crates/forge_walker/Cargo.toml
deny.toml

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch chore/pin-github-actions-20260501

✨ Simplify code

Create PR with simplified code
Commit simplified code in branch chore/pin-github-actions-20260501

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Review rate limit: 0/1 reviews remaining, refill in 32 minutes and 51 seconds.}

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

cursor

Cursor Bugbot has reviewed your changes and found 3 potential issues.

^{Bugbot Autofix is ON, but it could not run because the branch was deleted or merged before autofix could start.}

^{Reviewed by Cursor Bugbot for commit ca2a7f8. Configure here.}

cursor · 2026-05-02T03:08:34Z

+      - uses: taiki-e/upload-rust-binary-action@v1
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          tool: cargo-deny


Wrong GitHub Action used to install cargo-deny

High Severity

The workflow uses taiki-e/upload-rust-binary-action@v1, which is for building and uploading Rust binaries to GitHub Releases — not for installing tools. It doesn't accept a tool input. The correct action for installing cargo-deny is taiki-e/install-action@v2. As written, this step will either error out or silently not install cargo-deny, causing the subsequent cargo deny check step to fail with "command not found."

^{Reviewed by Cursor Bugbot for commit ca2a7f8. Configure here.}

cursor · 2026-05-02T03:08:34Z



 [workspace.package]
+license = "MIT"


Workspace license contradicts actual LICENSE file

High Severity

The workspace declares license = "MIT", but the repository's LICENSE file is Apache-2.0. This mismatch propagates to all 25 crates via license.workspace = true, causing every published crate to advertise an incorrect license. This creates a legal inconsistency between what the metadata declares and the actual license terms in the repository.

^{Reviewed by Cursor Bugbot for commit ca2a7f8. Configure here.}

cursor · 2026-05-02T03:08:34Z

+    "Unlicense",
+    "CDLA-Permissive-2.0",
+    "GPL-3.0-only",
+    "GPL-3.0-or-later",


GPL-3.0 allowed in permissively-licensed project's deny config

Medium Severity

The license allowlist includes GPL-3.0-only and GPL-3.0-or-later, which are copyleft licenses incompatible with the project's own permissive license (MIT per Cargo.toml, Apache-2.0 per LICENSE). This defeats the purpose of cargo-deny license checking — a GPL dependency could be added without being flagged, creating a legal incompatibility where the project can't be distributed under its declared permissive license.

^{Reviewed by Cursor Bugbot for commit ca2a7f8. Configure here.}

codeant-ai · 2026-05-02T03:10:00Z

CodeAnt AI finished reviewing your PR.

- Bootstrap deny.toml with license allowlist + advisory ignores - Add license = MIT to workspace.package (was missing) - Add license.workspace = true to all 27 crate manifests - Ignore transitive unmaintained (bincode, yaml-rust, paste, rustls-pemfile) - Ignore transitive vulns (hickory-proto, rustls-webpki) via aws-sdk/reqwest Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>

Copilot AI review requested due to automatic review settings May 2, 2026 03:06

KooshaPari merged commit c126175 into main May 2, 2026
1 check was pending

KooshaPari deleted the chore/pin-github-actions-20260501 branch May 2, 2026 03:06

github-actions Bot added the type: fix Iterations on existing features or infrastructure. label May 2, 2026

Copilot started reviewing on behalf of KooshaPari May 2, 2026 03:06 View session

codeant-ai Bot added the size:M label May 2, 2026

cursor Bot reviewed May 2, 2026

View reviewed changes

KooshaPari removed the request for review from Copilot May 2, 2026 03:28

KooshaPari restored the chore/pin-github-actions-20260501 branch June 8, 2026 09:13

KooshaPari added pr-created labels Jun 9, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ci: add cargo-deny config, fix workspace license - #3

ci: add cargo-deny config, fix workspace license#3
KooshaPari merged 1 commit into
mainfrom
chore/pin-github-actions-20260501

KooshaPari commented May 2, 2026 •

edited by codeant-ai Bot

Loading

Uh oh!

gemini-code-assist Bot commented May 2, 2026

Uh oh!

codeant-ai Bot commented May 2, 2026

Uh oh!

coderabbitai Bot commented May 2, 2026

Rate limit exceeded

Uh oh!

Uh oh!

cursor Bot left a comment

Uh oh!

cursor Bot May 2, 2026

Uh oh!

cursor Bot May 2, 2026

Uh oh!

cursor Bot May 2, 2026

Uh oh!

codeant-ai Bot commented May 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

KooshaPari commented May 2, 2026 • edited by codeant-ai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

User description

Summary

Test plan

CodeAnt-AI Description

What Changed

Impact

Checking Your Pull Request

Talking to CodeAnt AI

Example

Preserve Org Learnings with CodeAnt

Example

Retrigger review

Check Your Repository Health

Uh oh!

gemini-code-assist Bot commented May 2, 2026

Uh oh!

codeant-ai Bot commented May 2, 2026

Thanks for using CodeAnt! 🎉

Uh oh!

coderabbitai Bot commented May 2, 2026

Rate limit exceeded

Uh oh!

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor Bot May 2, 2026

Choose a reason for hiding this comment

Wrong GitHub Action used to install cargo-deny

Uh oh!

cursor Bot May 2, 2026

Choose a reason for hiding this comment

Workspace license contradicts actual LICENSE file

Uh oh!

cursor Bot May 2, 2026

Choose a reason for hiding this comment

GPL-3.0 allowed in permissively-licensed project's deny config

Uh oh!

codeant-ai Bot commented May 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

KooshaPari commented May 2, 2026 •

edited by codeant-ai Bot

Loading