From 559bf9d9d720d9e267f8c3c74c295f1811d0fe36 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E5=AE=89=E6=AD=A3=E8=B6=85?= <anzhengchao@gmail.com>
Date: Fri, 12 Jun 2026 11:11:40 +0800
Subject: [PATCH] ci(audit): wire cargo deny supply-chain gate (#3377)

---
 .github/workflows/audit.yml | 23 +++++++++++++++++++++++
 deny.toml                   | 10 ++++------
 2 files changed, 27 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml
index aba53426d..fb69bf371 100644
--- a/.github/workflows/audit.yml
+++ b/.github/workflows/audit.yml
@@ -20,12 +20,14 @@ on:
     paths:
       - '**/Cargo.toml'
       - '**/Cargo.lock'
+      - 'deny.toml'
       - '.github/workflows/audit.yml'
   pull_request:
     branches: [ main ]
     paths:
       - '**/Cargo.toml'
       - '**/Cargo.lock'
+      - 'deny.toml'
       - '.github/workflows/audit.yml'
   schedule:
     - cron: '0 0 * * 0' # Weekly on Sunday at midnight UTC
@@ -63,6 +65,27 @@ jobs:
           path: audit-results.json
           retention-days: 30
 
+  cargo-deny:
+    name: Cargo Deny
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Setup Rust environment
+        uses: ./.github/actions/setup
+        with:
+          cache-shared-key: rustfs-cargo-deny
+
+      - name: Install cargo-deny
+        uses: taiki-e/install-action@v2
+        with:
+          tool: cargo-deny
+
+      - name: Run cargo-deny
+        run: cargo deny check --hide-inclusion-graph advisories sources bans licenses
+
   dependency-review:
     name: Dependency Review
     runs-on: ubuntu-latest
diff --git a/deny.toml b/deny.toml
index 221bbe283..aee901ab8 100644
--- a/deny.toml
+++ b/deny.toml
@@ -33,6 +33,10 @@ ignore = [
     # in-process RSA decryption oracles are removed.
     # owner: rustfs-maintainers  review: 2026-07
     { id = "RUSTSEC-2023-0071", reason = "rsa Marvin timing sidechannel; no fixed upstream version; tracked separately" },
+    # `proc-macro-error2 2.0.1` — unmaintained. No direct dependency; pulled
+    # transitively through `mysql_async` via `mysql-common-derive`.
+    # owner: rustfs-maintainers  review: 2026-07
+    { id = "RUSTSEC-2026-0173", reason = "proc-macro-error2 unmaintained; transitive only via mysql_async; tracked for dependency refresh" },
 ]
 
 [sources]
@@ -43,12 +47,6 @@ allow-git = [
     # Custom S3 server library with minio compatibility patches not yet upstreamed.
     # Pinned to a specific commit in workspace Cargo.toml.
     "https://github.com/rustfs/s3s",
-    # Temporary git source for russh until required upstream fixes are released.
-    # owner: rustfs-maintainers  review: 2026-05
-    "https://github.com/Eugeny/russh",
-    # Temporary git source for mysql_async until required upstream fixes are released.
-    # owner: rustfs-maintainers  review: 2026-05
-    "https://github.com/blackbeam/mysql_async",
 ]
 
 [bans]