feat: Add cargo-deny

deny.toml

@@ -0,0 +1,42 @@
+[licenses]
+allow = [
+  "0BSD",
+  "Apache-2.0 WITH LLVM-exception",
+  "Apache-2.0",
+  "BSD-2-Clause",
+  "BSD-3-Clause",
+  "BSL-1.0",
+  "bzip2-1.0.6",
+  "CDLA-Permissive-2.0",
+  "ISC",
+  "MIT",
+  "MPL-2.0",
+  "Unicode-3.0",
+  "Zlib",
+]
+confidence-threshold = 0.8
+private = { ignore = true }
+
+[[licenses.clarify]]
+crate = "uv-auth"
+expression = "MIT OR Apache-2.0"
+license-files = [
+  { path = "../../LICENSE-APACHE", hash = 0x0 },
+  { path = "../../LICENSE-MIT", hash = 0x0 },
+]
+
+[[licenses.clarify]]
+crate = "uv-client"
+expression = "MIT OR Apache-2.0"
+license-files = [
+  { path = "../../LICENSE-APACHE", hash = 0x0 },
+  { path = "../../LICENSE-MIT", hash = 0x0 },
+]
+
+[[licenses.clarify]]
+crate = "uv-shell"
+expression = "MIT OR Apache-2.0"
+license-files = [
+  { path = "../../LICENSE-APACHE", hash = 0x0 },
+  { path = "../../LICENSE-MIT", hash = 0x0 },
+]

lefthook.yaml

@@ -21,6 +21,10 @@ pre-commit:
   jobs:
     - name: actionlint
       run: pixi {run} actionlint
+    - name: cargo-deny
+      glob: "Cargo.lock,Cargo.toml"
+      stage_fixed: true
+      run: pixi {run} cargo-deny
     - name: cargo-fmt
       glob: "*.rs"
       stage_fixed: true

pixi.toml

@@ -124,6 +124,7 @@ cmd = "pytest --inline-snapshot=fix -k '{{ expression }}'"
 [feature.lint.dependencies]
 actionlint = ">=1.7.7,<2"
 basedpyright = ">=1.31.4,<2"
+cargo-deny = ">=0.18.3,<0.19"
 dprint = ">=0.49.1,<0.51"
 go-shfmt = ">=3.11.0,<4"
 lefthook = ">=1.11.14,<2"
@@ -135,6 +136,7 @@ typos = ">=1.29.10,<2"
 [feature.lint.tasks]
 actionlint = { cmd = "actionlint", env = { SHELLCHECK_OPTS = "-e SC2086" } }
 cargo-clippy = "cargo clippy --all-targets --workspace -- -D warnings"
+cargo-deny = "cargo deny --workspace check license --deny warnings"
 cargo-fmt = "cargo fmt --all"
 check-openssl = "python tests/scripts/check-openssl.py"
 dprint-check = { cmd = "dprint check --log-level=silent", description = "Check formatting with dprint" }