From a20c5bcc622dfff3f9368f672d8ec7bafb70c5c6 Mon Sep 17 00:00:00 2001
From: furedea <132188853+furedea@users.noreply.github.com>
Date: Mon, 18 May 2026 16:54:07 +0900
Subject: [PATCH] ci: add cargo deny audit

---
 .github/workflows/ci.yml |  3 +++
 Cargo.toml               |  1 +
 deny.toml                | 20 ++++++++++++++++++++
 flake.nix                |  1 +
 4 files changed, 25 insertions(+)
 create mode 100644 deny.toml

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0333336..2e54c53 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -115,6 +115,9 @@ jobs:
         with:
           persist-credentials: false
 
+      - name: Run cargo-deny
+        uses: EmbarkStudios/cargo-deny-action@6c8f9facfa5047ec02d8485b6bf52b587b7777d1 # v2.0.18
+
       - name: Run cargo-machete
         uses: bnjbvr/cargo-machete@ac30a525c0a8d163a92d727b3ff079ee3f6ecb08 # v0.9.2
 
diff --git a/Cargo.toml b/Cargo.toml
index 8b04b44..ac621fe 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -2,6 +2,7 @@
 name = "template-rust"
 version = "0.1.0"
 edition = "2024"
+license = "MIT"
 
 [dependencies]
 
diff --git a/deny.toml b/deny.toml
new file mode 100644
index 0000000..95bb016
--- /dev/null
+++ b/deny.toml
@@ -0,0 +1,20 @@
+[advisories]
+version = 2
+yanked = "deny"
+
+[licenses]
+version = 2
+unused-allowed-license = "allow"
+allow = [
+  "Apache-2.0",
+  "MIT",
+]
+
+[bans]
+multiple-versions = "warn"
+wildcards = "deny"
+
+[sources]
+unknown-registry = "deny"
+unknown-git = "deny"
+allow-registry = ["https://github.com/rust-lang/crates.io-index"]
diff --git a/flake.nix b/flake.nix
index 4695ec2..40722a8 100644
--- a/flake.nix
+++ b/flake.nix
@@ -15,6 +15,7 @@
       devShells.${system}.default = pkgs.mkShell {
         packages = with pkgs; [
           cargo
+          cargo-deny
           cargo-machete
           clippy
           commitlint