From e6111c421fa8168f51e21a797fb7a45efa6e2fa2 Mon Sep 17 00:00:00 2001
From: Devid HW <devid.wahid@gmail.com>
Date: Tue, 25 Aug 2026 01:44:40 +0700
Subject: [PATCH] ci(security): add cargo-deny checks for advisories, licenses,
 bans, sources

---
 .github/workflows/rust.yml | 12 ++++++++++++
 deny.toml                  | 27 +++++++++++++++++++++++++++
 2 files changed, 39 insertions(+)
 create mode 100644 deny.toml

diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
index 87e16bd..5b3b143 100644
--- a/.github/workflows/rust.yml
+++ b/.github/workflows/rust.yml
@@ -20,3 +20,15 @@ jobs:
       run: cargo build --verbose
     - name: Run tests
       run: cargo test --verbose
+
+  cargo-deny:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        checks: [advisories, bans, licenses, sources]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: embarkstudios/cargo-deny-action@3c6349835b2b7b196a839186cb8b78e02f7b5f25 # v2.1.1
+        with:
+          command: check ${{ matrix.checks }}
+          log-level: warn
diff --git a/deny.toml b/deny.toml
new file mode 100644
index 0000000..c48890b
--- /dev/null
+++ b/deny.toml
@@ -0,0 +1,27 @@
+# cargo-deny configuration — https://embarkstud.io.github.io/cargo-deny/
+
+[advisories]
+version = 2
+yanked = "deny"
+
+[licenses]
+version = 2
+allow = [
+  "MIT",
+  "Apache-2.0",
+  "Apache-2.0 WITH LLVM-exception",
+  "BSD-2-Clause",
+  "BSD-3-Clause",
+  "ISC",
+  "Unicode-3.0",
+  "Zlib",
+  "CDLA-Permissive-2.0",
+  # via option-ext ← dirs-sys ← dirs
+  "MPL-2.0",
+]
+
+[bans]
+multiple-versions = "warn"
+
+[sources]
+unknown-registry = "warn"