feat: add cargo-deny for supply chain safety

Add dependency auditing via cargo-deny to catch license violations,
security advisories, and untrusted sources. Integrates into CI as a
parallel job alongside clippy, and into the local quality gate script.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

.github/workflows/code_style.yml

@@ -16,6 +16,17 @@ jobs:
     - name: Check formatting
       run: cargo fmt --all -- --check
 
+  deny-check:
+    name: cargo-deny
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v6
+    - name: Install cargo-deny
+      run: cargo install cargo-deny
+    - name: Run cargo deny
+      run: cargo deny check
+
   clippy:
     name: Clippy (${{ matrix.name }})
     runs-on: ubuntu-latest
@@ -71,13 +82,13 @@ jobs:
 
   # Roll-up job for branch protection
   code-style:
-    name: Code Style (fmt + clippy)
+    name: Code Style (fmt + clippy + deny)
     runs-on: ubuntu-latest
     if: always()
-    needs: [format, clippy, clippy-windows]
+    needs: [format, clippy, clippy-windows, deny-check]
     steps:
       - run: |
-          if [[ "${{ needs.format.result }}" != "success" || "${{ needs.clippy.result }}" != "success" ]]; then
+          if [[ "${{ needs.format.result }}" != "success" || "${{ needs.clippy.result }}" != "success" || "${{ needs.deny-check.result }}" != "success" ]]; then
             echo "One or more jobs failed"
             exit 1
           fi

deny.toml

@@ -0,0 +1,40 @@
+[graph]
+targets = []
+
+[advisories]
+unmaintained = "warn"
+yanked = "deny"
+ignore = [
+    # Add specific RUSTSEC IDs with justification comments as needed
+]
+
+[licenses]
+unlicensed = "deny"
+default = "deny"
+allow = [
+    "MIT",
+    "Apache-2.0",
+    "Apache-2.0 WITH LLVM-exception",
+    "BSD-2-Clause",
+    "BSD-3-Clause",
+    "ISC",
+    "Unicode-3.0",
+    "Unicode-DFS-2016",
+    "OpenSSL",
+    "Zlib",
+    "MPL-2.0",
+    "0BSD",
+    "BSL-1.0",
+    "CC0-1.0",
+]
+unused-allowed-license = "allow"
+
+[bans]
+multiple-versions = "warn"
+wildcards = "allow"
+
+[sources]
+unknown-registry = "deny"
+unknown-git = "deny"
+allow-registry = ["https://github.com/rust-lang/crates.io-index"]
+allow-git = []

scripts/ci/quality_gate_strict.sh

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+echo "==> fmt check"
+cargo fmt --all -- --check
+
+echo "==> clippy (all warnings)"
+cargo clippy --locked --all --benches --tests --examples --all-features -- -D warnings
+
+echo "==> cargo deny"
+cargo deny check 2>/dev/null || echo "WARN: cargo-deny not installed, skipping"
+
+echo "==> tests"
+cargo test --locked