ci(actions): ✅ add dependency graph check with cargo-deny

.github/workflows/testing.yml

@@ -19,7 +19,7 @@ jobs:
         uses: moonrepo/setup-rust@v1
         with:
           channel: stable
-          bins: cargo-deb, cargo-hack
+          bins: cargo-deb, cargo-hack, cargo-deny
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       - name: Install dependencies
@@ -40,3 +40,5 @@ jobs:
           path: target/debian/*.deb
       - name: Check for MSRV compliance
         run: cargo hack check --rust-version --all-targets --each-feature --workspace
+      - name: Check dependency graph
+        run: cargo deny --all-features --workspace check

deny.toml

@@ -0,0 +1,23 @@
+[graph]
+targets = [
+    "x86_64-unknown-linux-gnu",
+    "x86_64-unknown-linux-musl",
+    "aarch64-unknown-linux-gnu",
+    "aarch64-unknown-linux-musl",
+]
+
+[licenses]
+allow = [
+    "MIT",
+    "Apache-2.0",
+    "BSD-3-Clause",
+    "Unicode-DFS-2016",
+]
+
+[[bans.skip]]
+crate = "[email protected]"
+reason = "Upstream https://github.com/tokio-rs/prost/issues/1009"
+
+[[bans.skip-tree]]
+crate = "[email protected]"
+reason = "tonic 0.11.0 is not compatible with tokio 1.0"

xtask/Cargo.toml

@@ -1,7 +1,9 @@
 [package]
 name = "xtask"
 version.workspace = true
+authors.workspace = true
 edition.workspace = true
+license.workspace = true
 rust-version.workspace = true
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html