ci: add cargo-deny for license, advisory, and source auditing

[jpoehnelt]

Adds a deny.toml configuration for cargo-deny to enforce supply chain policies:

• Advisories: Checks against the RustSec advisory database for known vulnerable crates
• Licenses: Allowlist of permissive licenses compatible with the project's Apache-2.0 license
• Bans: Warns on duplicate crate versions in the dependency tree
• Sources: Restricts dependencies to crates.io only (denies unknown registries and git sources)

Verified locally: cargo deny check passes cleanly (advisories ok, bans ok, licenses ok, sources ok).

Part of supply chain hardening effort.

[changeset-bot]

🦋 Changeset detected

Latest commit: ac13de0

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@googleworkspace/cli	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[gemini-code-assist]

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request implements supply chain hardening by integrating cargo-deny into the project's CI pipeline. By establishing automated checks for dependency integrity and licensing, the project ensures better compliance and security posture for its Rust dependencies.

Highlights

• Supply Chain Security: Introduced cargo-deny to enforce security policies regarding crate vulnerabilities, license compliance, and dependency sources.
• Configuration: Added a comprehensive deny.toml file defining allowlists for licenses and restricting dependencies to the official crates.io registry.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Footnotes

1. Review the Generative AI Prohibited Use Policy, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request introduces a cargo-deny configuration to audit licenses, advisories, and crate sources, along with a corresponding changeset. The review feedback recommends hardening the security configuration by denying multiple versions of the same crate and prohibiting wildcard dependencies to improve supply chain security and ensure explicit version constraints.

[googleworkspace-bot]

/gemini review

[gemini-code-assist]

Code Review

This pull request introduces a cargo-deny configuration file (deny.toml) to audit licenses, advisories, and crate sources for the project. The review feedback suggests relaxing the multiple-versions policy from 'deny' to 'warn' to prevent build failures caused by unavoidable transitive dependency duplicates. Additionally, it is recommended to include the crates.io sparse index URL in the allowed registries to ensure compatibility with modern Cargo defaults.

[googleworkspace-bot]

/gemini review

[gemini-code-assist]

Code Review

This pull request introduces a cargo-deny configuration to audit licenses, advisories, and crate sources, along with a corresponding changeset. The review feedback recommends removing a shell-specific path to ensure cross-platform compatibility and suggests hardening the supply chain by denying multiple versions of the same crate.

[googleworkspace-bot]

/gemini review

[gemini-code-assist]

Code Review

This pull request introduces a cargo-deny configuration to audit licenses, advisories, and crate sources for the project. Feedback focuses on strengthening the security posture by explicitly denying unmaintained or unsound crates in the advisories section and preventing multiple versions of the same crate. Additionally, it was noted that the cargo-deny check needs to be integrated into the CI pipeline to ensure the policies are actually enforced.

[googleworkspace-bot]

/gemini review

[gemini-code-assist]

Code Review

This pull request introduces a cargo-deny configuration file and a corresponding changeset to enable license, advisory, and source auditing for the project. The review feedback highlights the need to integrate cargo-deny into the CI pipeline and local git hooks to ensure enforcement. Additionally, suggestions were made to harden the configuration by explicitly denying vulnerabilities, yanked crates, and unlicensed dependencies.

[googleworkspace-bot]

/gemini review

[googleworkspace-bot]

/gemini review

[gemini-code-assist]

Code Review

This pull request introduces a cargo-deny configuration file and a changeset to enable license, advisory, and source auditing for the project. The reviewer recommended integrating the tool into the CI pipeline to ensure enforcement, as the configuration alone does not trigger checks. Additionally, suggestions were made to harden the security posture by explicitly denying unmaintained or unsound crates and enforcing a single-version policy for dependencies.

[gemini-code-assist]

Code Review

This pull request introduces cargo-deny configuration to the project by adding a deny.toml file and a corresponding changeset. The configuration establishes policies for security advisories, license compliance, crate bans, and allowed source registries. I have no feedback to provide.