Run analysis tools

.circleci/config.yml

@@ -349,6 +349,40 @@ jobs:
             # TODO: Clippy different feature sets (std, test, bench, ...)
       - save-sccache-cache
       - codechecks
+  check-deps:
+    executor: docker-rust
+    steps:
+      - checkout
+      - run:
+          name: Install tools
+          command: |
+            # TODO: Move to docker file
+            cargo install cargo-outdated
+            cargo install cargo-audit
+            cargo install cargo-geiger
+      - run:
+          name: Generate lockfile
+          command: cargo generate-lockfile
+      - run:
+          name: Check for outdated dependencies
+          command: cargo outdated
+      - run:
+          name: Check for vulnerabilities
+          command: cargo audit
+      - run:
+          name: Check for use of unsafe
+          command: cargo geiger # TODO: needs to be in project
+      - run:
+          name: Check for outdated in substrate-runtime-wasm
+          command: |
+            pushd 0xchain/substrate-runtime-wasm
+            cargo outdated
+      - run:
+          name: Check for vulnerabilities in substrate-runtime-wasm
+          command: |
+            pushd 0xchain/substrate-runtime-wasm
+            cargo audit
+
   accept:
     executor: minimal
     steps:

Cargo.toml

@@ -27,5 +27,5 @@ panic = 'unwind'
 # HACK: Patch replace substrate's dependency on hex-literal with a local clone
 # that sets #[no_std].
 # TODO: Remove pending merger of https://github.com/RustCrypto/utils/pull/30
-[replace]
-"hex-literal:0.1.4" = { path = "./vendor/hex-literal" }
+#[replace]
+#"hex-literal:0.1.4" = { path = "./vendor/hex-literal" }