mirror of
https://github.com/Such-Software/smirk-backend-core.git
synced 2026-10-17 15:31:38 +02:00
jwinterm
143f00701b
- minimal Axum server exposing GET /health - OpenAPI contract generated from handlers (gen_openapi -> openapi.json), drift-gated in CI so the spec can never silently diverge from the code - CI: secret-scan + gitleaks, openapi drift gate, fmt/clippy/build/test/doc-test, cargo-deny - Cargo.lock tracked for reproducible builds; publish=false; pinned toolchain - README, SECURITY.md, deny.toml, .env.example
37 lines
828 B
TOML
37 lines
828 B
TOML
# cargo-deny configuration — supply-chain gate for the public backend.
|
|
# Run locally with: cargo deny check
|
|
|
|
[advisories]
|
|
version = 2
|
|
# Fail on known-vulnerable or yanked crates (RUSTSEC advisory DB).
|
|
yanked = "deny"
|
|
|
|
[bans]
|
|
# Duplicate versions bloat the build and the audit surface; surface but don't block.
|
|
multiple-versions = "warn"
|
|
wildcards = "deny"
|
|
|
|
[licenses]
|
|
version = 2
|
|
# Permissive + weak-copyleft licenses we accept in the dependency tree.
|
|
allow = [
|
|
"MIT",
|
|
"Apache-2.0",
|
|
"Apache-2.0 WITH LLVM-exception",
|
|
"BSD-2-Clause",
|
|
"BSD-3-Clause",
|
|
"ISC",
|
|
"Unicode-DFS-2016",
|
|
"Unicode-3.0",
|
|
"Zlib",
|
|
"MPL-2.0",
|
|
"CC0-1.0",
|
|
"OpenSSL",
|
|
]
|
|
confidence-threshold = 0.9
|
|
|
|
[sources]
|
|
# Only crates.io; no unvetted git or alternate registries.
|
|
unknown-registry = "deny"
|
|
unknown-git = "deny"
|