ci: enforce the crate map with cargo-deny and a closure-ban script #174

Merged

natsukium merged 2 commits from ci/deny-crate-map into main 2026-10-18 23:11:34 +09:00

Conversation 0 Commits 2 Files changed 12 +290 -202

natsukium commented 2026-10-18 21:13:39 +09:00

Owner

Copy link

The library crates get published from v0.3.0 (#160). crates/felis-protocol/tests/crate_purity.rs and crates/felis-grid/tests/no_render_deps.rs ran cargo tree over the workspace from a crate's own tests, so they would ship in the published package and fail outside the workspace. This moves every dependency rule into repository tooling and, on the way, makes the whole crate map tool-enforced instead of "review enforces the rest".

• deny.toml encodes the "Depends on" column. Each felis library crate gets a wrappers entry listing exactly the crates allowed to depend on it directly, so a new felis→felis edge fails cargo deny until the map and deny.toml change together. Plus swash only under felis-shaping (next to #171's wgpu/winit). Dev parents are listed after a # dev marker: [graph] exclude-dev would also drop dev dependencies from the license and advisory checks. [graph] all-features = true so optional edges are judged too.
• tools/dep_bans.py encodes the "MUST NOT depend on" column over each crate's closure (cargo tree --edges normal,build --target all --all-features), for what wrappers cannot express (e.g. felis-protocol's OS-crate ban: libc, rustix, windows-sys have dozens of external parents). With --self-test; run by just deny (already in pr.yml/release.yml) and just selftest.
• Every entry of both deleted tests' ban lists is still caught (same edge/target flags, now with --all-features); newly enforced: tokio in vt/grid, OS crates in vt, felis-crate bans for pty/transport, render crates for daemon, swash/wgpu/winit closures for client-core/cli/shaping/render-core/render-wgpu.
• Verified by deliberate violations, each reverted: grid→shaping fails both checks; protocol + libc, and protocol + cfg(windows) windows-sys, fail the script.
• Docs: workspace.md enforcement paragraph, testing.md, security-audits.md, overview.md ("Rejected workspace shapes": a dependency ban written as a test in its own crate), test-strategy skill, READMEs, CONTRIBUTING.

Known gap, stated in workspace.md: a crate already listed as a dev parent that promotes the edge to a normal dependency passes cargo deny; the script catches it only when the target is in that crate's MUST NOT cell. Not caught today: client-core/cli → daemon or pty, daemon → client-core. Closing it means adding those to the MUST NOT cells, a normative change left out of this PR.

Verified: just check green locally; sol review PASS (round 2; round 1's finding fixed in the second commit).

The library crates get published from v0.3.0 (#160). `crates/felis-protocol/tests/crate_purity.rs` and `crates/felis-grid/tests/no_render_deps.rs` ran `cargo tree` over the workspace from a crate's own tests, so they would ship in the published package and fail outside the workspace. This moves every dependency rule into repository tooling and, on the way, makes the whole crate map tool-enforced instead of "review enforces the rest". - **`deny.toml` encodes the "Depends on" column.** Each felis library crate gets a `wrappers` entry listing exactly the crates allowed to depend on it directly, so a new felis→felis edge fails `cargo deny` until the map and `deny.toml` change together. Plus `swash` only under felis-shaping (next to #171's `wgpu`/`winit`). Dev parents are listed after a `# dev` marker: `[graph] exclude-dev` would also drop dev dependencies from the license and advisory checks. `[graph] all-features = true` so optional edges are judged too. - **`tools/dep_bans.py` encodes the "MUST NOT depend on" column** over each crate's closure (`cargo tree --edges normal,build --target all --all-features`), for what `wrappers` cannot express (e.g. felis-protocol's OS-crate ban: libc, rustix, windows-sys have dozens of external parents). With `--self-test`; run by `just deny` (already in pr.yml/release.yml) and `just selftest`. - Every entry of both deleted tests' ban lists is still caught (same edge/target flags, now with `--all-features`); newly enforced: tokio in vt/grid, OS crates in vt, felis-crate bans for pty/transport, render crates for daemon, swash/wgpu/winit closures for client-core/cli/shaping/render-core/render-wgpu. - Verified by deliberate violations, each reverted: grid→shaping fails both checks; protocol + `libc`, and protocol + `cfg(windows)` `windows-sys`, fail the script. - Docs: workspace.md enforcement paragraph, testing.md, security-audits.md, overview.md ("Rejected workspace shapes": a dependency ban written as a test in its own crate), test-strategy skill, READMEs, CONTRIBUTING. **Known gap, stated in workspace.md:** a crate already listed as a dev parent that promotes the edge to a normal dependency passes `cargo deny`; the script catches it only when the target is in that crate's MUST NOT cell. Not caught today: client-core/cli → daemon or pty, daemon → client-core. Closing it means adding those to the MUST NOT cells, a normative change left out of this PR. Verified: `just check` green locally; sol review PASS (round 2; round 1's finding fixed in the second commit).

natsukium added 2 commits 2026-10-18 21:13:39 +09:00

ci, docs: enforce the crate map with cargo-deny and a closure-ban script ... 97d5322fce

The felis-protocol and felis-grid dependency bans ran as tests in the
crates' own tests/, shelling out to cargo tree. Once those crates are
published, the tests ship in the package and check repository policy
wherever a packager runs them; the bans now run from the repository root
under just deny, which CI already runs.

deny.toml encodes the "Depends on" column as wrappers, so a felis->felis
edge the map does not list fails cargo deny. Dev parents are listed in the
wrappers under a marker: cargo-deny's graph has dev edges and its only way
to drop them, graph.exclude-dev, would also drop dev dependencies from the
license and advisory checks. tools/dep_bans.py covers the transitive
"MUST NOT depend on" bans that wrappers cannot express.

ci: run cargo-deny over every feature ... 73df197db7

The crate-map wrappers judge direct edges only in the graph cargo-deny
builds, which left optional dependencies out: an unlisted parent could
reach a felis crate behind a non-default feature. dep_bans.py already
checks closures with --all-features; the deny graph now matches.

natsukium force-pushed ci/deny-crate-map from 73df197db7 to e41b54cf32 2026-10-18 22:50:15 +09:00 Compare

natsukium force-pushed ci/deny-crate-map from e41b54cf32 to 416a63805e 2026-10-18 22:59:08 +09:00 Compare

natsukium force-pushed ci/deny-crate-map from 416a63805e to d1f60cd8ff 2026-10-18 22:59:20 +09:00 Compare

natsukium scheduled this pull request to auto merge when all checks succeed 2026-10-18 23:06:28 +09:00

natsukium merged commit 6e85f20800 into main 2026-10-18 23:11:34 +09:00

natsukium deleted branch ci/deny-crate-map 2026-10-18 23:11:35 +09:00

natsukium referenced this pull request from a commit 2026-10-18 23:11:37 +09:00

Merge pull request 'ci: enforce the crate map with cargo-deny and a closure-ban script' (#174) from ci/deny-crate-map into main

natsukium referenced this pull request 2026-10-19 09:20:41 +09:00

daemon: settle the ownership keystroke before asserting a quiet report #185

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

Area/ci

CI workflows (.forgejo/workflows/)

  

Area/cli

felis-cli crate, the felis front-door binary

  

Area/client

felis-client crate, the winit GUI frontend

  

Area/client-core

felis-client-core crate, shadow screen, config, connect_or_spawn_daemon

  

Area/daemon

felis-daemon crate, session pool, IPC server

  

Area/deps

Dependency bumps

  

Area/docs

Documentation tree when no narrower area fits

  

Area/grid

felis-grid crate, cells, scrollback, image store

  

Area/manual

User-facing docs: tutorials, how-to, user-facing reference pages

  

Area/nix

Nix flake, home-manager module, package definitions

  

Area/protocol

felis-protocol crate, felis.proto, frame layout, version constants

  

Area/pty

felis-pty crate, PTY backends

  

Area/render

felis-render-wgpu crate, GPU pipeline, atlas

  

Area/shaping

felis-shaping crate, swash shaper, font fallback

  

Area/skills

Agent skills (skills/felis, .agents/skills/)

  

Area/transport

felis-transport crate, framing, socket/pipe, SSH carrier

  

Area/vt

felis-vt crate, VT parser, dispatch

  

Compat/Breaking

Breaking change that won't be backward compatible

  

Kind/Bug

Something is not working

  

Kind/Documentation

Documentation changes

  

Kind/Enhancement

Improve existing functionality

  

Kind/Feature

New functionality

  

Kind/Performance

Throughput, latency, or memory cost

  

Kind/Security

This is security issue

  

Kind/Testing

Issue or pull request related to testing

  

perf-regression-accepted

Passes the instruction-count bench gate for an intended cost; state why in a PR comment

  

Reviewed

Confirmed

Issue has been confirmed

  

Reviewed

Duplicate

This issue or pull request already exists

  

Reviewed

Invalid

Invalid issue

  

Reviewed

Won't Fix

This issue won't be fixed

  

Status

Blocked

Something is blocking this issue or pull request

  

Status

Need More Info

Feedback is required to reproduce issue or to continue work

  

Status

Upstream

Waiting on a change in an upstream project

No labels

Area/ci

Area/cli

Area/client

Area/client-core

Area/daemon

Area/deps

Area/docs

Area/grid

Area/manual

Area/nix

Area/protocol

Area/pty

Area/render

Area/shaping

Area/skills

Area/transport

Area/vt

Compat/Breaking

Kind/Bug

Kind/Documentation

Kind/Enhancement

Kind/Feature

Kind/Performance

Kind/Security

Kind/Testing

perf-regression-accepted

Reviewed

Confirmed

Reviewed

Duplicate

Reviewed

Invalid

Reviewed

Won't Fix

Status

Blocked

Status

Need More Info

Status

Upstream

Milestone

Clear milestone

No items

No milestone

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

felis-terminal/felis!174

No description provided.