chore(ci): add cargo-deny, deny warnings, and dependency policy fixes

.github/workflows/ci.yml

@@ -12,6 +12,23 @@ env:
   RUSTFLAGS: "-D warnings"
 
 jobs:
+  deny:
+    runs-on: ubuntu-latest
+    env:
+      CARGO_DENY_VERSION: "0.19.6"
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Install cargo-deny
+        run: |
+          curl -sL "https://github.com/EmbarkStudios/cargo-deny/releases/download/${CARGO_DENY_VERSION}/cargo-deny-${CARGO_DENY_VERSION}-x86_64-unknown-linux-musl.tar.gz" | tar xz -C /usr/local/bin --strip-components=1
+
+      - name: Check dependencies
+        run: cargo deny check
+
   build-and-test:
     runs-on: ubuntu-latest
     steps:

Cargo.toml

@@ -9,6 +9,7 @@ members = [
 version = "0.3.0"
 edition = "2021"
 license = "Apache-2.0"
+publish = false
 repository = "https://github.com/ROCm/spur-cloud"
 
 [workspace.dependencies]
@@ -67,7 +68,7 @@ futures-util = "0.3"
 bytes = "1"
 url = "2"
 base64 = "0.22"
-rand = "0.8"
+rand = "0.8.6"
 sha2 = "0.10"
 semver = "1"
 

crates/spur-cloud-api/Cargo.toml

@@ -2,6 +2,8 @@
 name = "spur-cloud-api"
 version.workspace = true
 edition.workspace = true
+license.workspace = true
+publish.workspace = true
 
 [[bin]]
 name = "spur-cloud-api"

crates/spur-cloud-common/Cargo.toml

@@ -2,6 +2,8 @@
 name = "spur-cloud-common"
 version.workspace = true
 edition.workspace = true
+license.workspace = true
+publish.workspace = true
 
 [dependencies]
 serde.workspace = true

deny.toml

@@ -0,0 +1,43 @@
+[graph]
+all-features = true
+
+[advisories]
+yanked = "warn"
+unmaintained = "workspace"
+
+[licenses]
+confidence-threshold = 0.8
+
+allow = [
+    "MIT",
+    "Apache-2.0",
+    "Apache-2.0 WITH LLVM-exception",
+    "BSD-2-Clause",
+    "BSD-3-Clause",
+    "ISC",
+    "Unicode-3.0",
+    "Zlib",
+    "BSL-1.0",
+    "Unlicense",
+    "CDLA-Permissive-2.0",
+]
+
+# Git-sourced spur-proto uses license.workspace = true; synthesized manifest has no license field.
+[[licenses.clarify]]
+name = "spur-proto"
+expression = "Apache-2.0"
+license-files = [
+    { path = "../../LICENSE", hash = 0x001c7e6c },
+]
+
+[bans]
+multiple-versions = "warn"
+wildcards = "deny"
+allow-wildcard-paths = true
+
+[sources]
+unknown-registry = "deny"
+unknown-git = "deny"
+allow-git = [
+    "https://github.com/ROCm/spur",
+]