Repository navigation
ci: exempt the rust-cache action from the copyleft gate - #30
Merged
Merged
Conversation
Swatinem/rust-cache is LGPL-3.0, which dependency-review denies. CI actions run on the runner and are never distributed with the Apache-2.0 binaries, so copyleft there cannot reach the product; the crate policy in deny-licenses and deny.toml is unchanged. Scoped to this one action rather than relaxing the ecosystem.
plusky
added
github_actions
plusky
enabled auto-merge (rebase)
August 24, 2026 16:18
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Swatinem/rust-cacheis licensed LGPL-3.0, whichdependency-review.yml's deny-list rejects — so #29, and every future rust-cache pin bump, is blocked.Worth noting: the currently pinned SHA is LGPL-3.0 as well. The action only surfaces on a pin change because dependency-review inspects changed dependencies only, so holding the old pin defers the problem rather than avoiding it.
The deny-list mirrors
deny.toml, which governs crates linked into the distributed Apache-2.0 binaries. A GitHub Action only runs on the CI runner and is never shipped, so its copyleft licence cannot reach the product.This adds a scoped exemption for that single action (
pkg:githubactions/Swatinem/rust-cache) rather than relaxing the rule for the actions ecosystem or weakening the crate policy. All 15 denied licences remain in force for everything else, anddeny.tomlis untouched.Unblocks #29.