Skip to content
You're viewing an older version of this GitHub Action. Do you want to see the latest version instead?
slash

GitHub Action

cargo-deny

v1.5.6

cargo-deny

slash

cargo-deny

Help manage Cargo crate dependencies and validate licenses

Installation

Copy and paste the following snippet into your .yml file.

 
              
- name: cargo-deny

              
  uses: EmbarkStudios/[email protected]
Learn more about this action in EmbarkStudios/cargo-deny-action

Choose a version

❌ cargo-deny GitHub Action

GitHub Action for running cargo-deny to help manage Cargo crate dependencies and validate licenses.

Build Status Contributor Covenant Embark

Usage

Create a deny.toml file in the root of the repo to use as rules for the action (example). See cargo-deny for instructions and details of the format and capabilities.

This action will run cargo-deny check and report failure if any banned crates or disallowed open source licenses are found used in the crate or its dependencies.

The action has three optional inputs

  • rust-version: The rust/cargo version to use, updated before cargo-deny is run. Defaults to the version in the image, which is currently 1.65.0.
  • log-level: The log level to use for cargo-deny, default is warn
  • command: The command to use for cargo-deny, default is check
  • arguments: The argument to pass to cargo-deny, default is --all-features. See Common Options for a list of the available options.
  • command-arguments The argument to pass to the command, default is emtpy. See options for each command.
  • credentials This argument stores the credentials in the file $HOME/git-credentials, and configures git to use it. The credential must match the format https://user:[email protected]

Example pipeline

name: CI
on: [push, pull_request]
jobs:
  cargo-deny:
    runs-on: ubuntu-22.04
    steps:
    - uses: actions/checkout@v3
    - uses: EmbarkStudios/cargo-deny-action@v1

Example pipeline with custom options using default values

name: CI
on: [push, pull_request]
jobs:
  cargo-deny:
    runs-on: ubuntu-22.04
    steps:
    - uses: actions/checkout@v3
    - uses: EmbarkStudios/cargo-deny-action@v1
      with:
        log-level: warn
        command: check
        arguments: --all-features
        command-arguments: ""
        credentials: https://${{ secrets.GITHUB_USER }}:${{ secrets.GITHUB_PAT }}@github.com

Use specific Rust version

name: CI
on: [push, pull_request]
jobs:
  cargo-deny:
    runs-on: ubuntu-22.04
    steps:
    - uses: actions/checkout@v3
    - uses: EmbarkStudios/cargo-deny-action@v1
      with:
        rust-version: "1.60.0"
        log-level: warn
        command: check
        arguments: --all-features

Recommended pipeline if not using advisories, to only run on dependency changes

If you use this pipeline, you should have Cargo.lock files checked into your repository.

name: CI
on:
  pull_request:
    paths:
      - '**/Cargo.lock'
      - '**/Cargo.toml'
jobs:
  cargo-deny:
    runs-on: ubuntu-22.04
    steps:
    - uses: actions/checkout@v3
    - uses: EmbarkStudios/cargo-deny-action@v1
      with:
        command: check bans licenses sources

Recommended pipeline if using advisories, to avoid sudden breakages

name: CI
on: [push, pull_request]
jobs:
  cargo-deny:
    runs-on: ubuntu-22.04
    strategy:
      matrix:
        checks:
          - advisories
          - bans licenses sources

    # Prevent sudden announcement of a new advisory from failing ci:
    continue-on-error: ${{ matrix.checks == 'advisories' }}

    steps:
    - uses: actions/checkout@v3
    - uses: EmbarkStudios/cargo-deny-action@v1
      with:
        command: check ${{ matrix.checks }}

Users

Repositories using this action (PR to add your repo):

Contributing

We welcome community contributions to this project.

Please read our Contributor Guide for more information on how to get started.

License

Licensed under either of

at your option.

Contribution

Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in the work by you, as defined in the Apache-2.0 license, shall be dual licensed as above, without any additional terms or conditions.