From a646650f6288db9c07eb74fc14a8409054bbc7c1 Mon Sep 17 00:00:00 2001
From: Shane Wall <shane.wall@gmail.com>
Date: Sun, 17 May 2026 21:36:43 +1000
Subject: [PATCH] Enforce cargo deny in CI

Add a dependency-policy job to the main CI workflow so cargo-deny runs against the workspace on every push and pull request, using the existing deny.toml policy.

Remove the stale Unicode-DFS-2016 license allow-list entry that cargo-deny reported as unmatched. Unicode-3.0 remains allowed for the current ICU-related crates.

Validation: cargo deny check; cargo tree --duplicates; cargo bloat --release --crates -n 30; actionlint .github/workflows/ci.yml .github/workflows/compliance.yml; git diff --check
---
 .github/workflows/ci.yml | 14 ++++++++++++++
 deny.toml                |  1 -
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b22a516..15c6dd6 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -11,6 +11,20 @@ env:
   RUST_BACKTRACE: 1
 
 jobs:
+  dependency-policy:
+    name: Dependency Policy
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v6
+
+    - name: Check dependency policy
+      uses: EmbarkStudios/cargo-deny-action@v2
+      with:
+        command: check all
+        arguments: --workspace
+
   # Main build and test job with S3 features (default)
   build-and-test:
     runs-on: ubuntu-latest
diff --git a/deny.toml b/deny.toml
index 3b537ed..6f3c1da 100644
--- a/deny.toml
+++ b/deny.toml
@@ -29,7 +29,6 @@ allow = [
     "CC0-1.0",
     "CDLA-Permissive-2.0",  # Community Data License Agreement - used by webpki-roots
     "Zlib",
-    "Unicode-DFS-2016",
     "Unicode-3.0",  # Unicode License v3 - used by ICU crates
     "MPL-2.0",
 ]