ci: add cargo-deny for `paste` crate by dyc3 · Pull Request #9579 · biomejs/biome

dyc3 · 2026-03-21T20:34:42Z

Summary

Adds cargo-deny to our ci to prevent pulling in this crate again.

generated by opus 4.6

Test Plan

ci should be green

Docs

changeset-bot · 2026-03-21T20:34:47Z

⚠️ No Changeset found

Latest commit: 609f7c6

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

coderabbitai · 2026-03-21T20:36:40Z

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 46d6379b-0168-4702-a6e5-c6dec45630b0

📥 Commits

Reviewing files that changed from the base of the PR and between 1a001c9 and 609f7c6.

📒 Files selected for processing (2)

.github/workflows/main.yml
.github/workflows/pull_request.yml

Walkthrough

Adds a new GitHub Actions job deny (named "Cargo Deny") that runs on depot-ubuntu-24.04-arm. The job is inserted to run after check-dependencies and before test, checks out the code, installs cargo-deny via taiki-e/install-action, and runs cargo deny check bans. The pull_request workflow filter was extended to include deny.toml. A new deny.toml config sets all-features = true, multiple-versions = "allow", and bans the paste crate with use-instead = "pastey".

Possibly related PRs

chore: fix vulnerabilities in dependencies #9576 — Removes or replaces uses of the paste crate, addressing the same banned crate enforced by the new deny.toml.

Suggested reviewers

arendjr

🚥 Pre-merge checks | ✅ 2

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely summarises the main change: adding cargo-deny CI configuration to prevent the `paste` crate from being pulled in again.
Description check	✅ Passed	The description is directly related to the changeset, explaining the motivation (preventing the `paste` crate) and the test plan, though it's quite brief.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch dyc3/cargo-deny

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Tip

CodeRabbit can use TruffleHog to scan for secrets in your code with verification capabilities.

Add a TruffleHog config file (e.g. trufflehog-config.yml, trufflehog.yml) to your project to customize detectors and scanning behavior. The tool runs only when a config file is present.

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.github/workflows/pull_request.yml:
- Around line 69-78: The pull_request.paths filter currently excludes deny.toml
so the "deny" job (job name: deny) can be skipped; update the pull_request.paths
configuration to include "deny.toml" and ".github/workflows/**" in the paths
list so changes to deny.toml or workflows will trigger the deny job (ensure the
existing exclude/include patterns are adjusted accordingly).

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 6a76b61e-0f9b-4ce0-9a0a-7fb98e1148d5

📥 Commits

Reviewing files that changed from the base of the PR and between a62487a and dd923cb.

📒 Files selected for processing (3)

.github/workflows/main.yml
.github/workflows/pull_request.yml
deny.toml

.github/workflows/pull_request.yml

coderabbitai

♻️ Duplicate comments (1)

.github/workflows/pull_request.yml (1)

9-17: ⚠️ Potential issue | 🟠 Major

Include workflow file changes in pull_request.paths.

Line 17 adds deny.toml, good catch — but without .github/workflows/**, CI-only edits can still dodge this workflow.

Suggested patch

     paths: # Only run when changes are made to rust code or root Cargo
       - "crates/**"
       - "fuzz/**"
       - "xtask/**"
       - "Cargo.toml"
       - "Cargo.lock"
       - "rust-toolchain.toml"
       - "rustfmt.toml"
       - "deny.toml"
+      - ".github/workflows/**"

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/workflows/pull_request.yml around lines 9 - 17, The pull_request
workflow's paths list (pull_request.paths) omits workflow files so changes to CI
YAML can bypass the job; update the paths array to include the workflow
directory pattern ".github/workflows/**" (in addition to the existing entries
like "deny.toml") so edits to workflow files will trigger the pull_request
workflow.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Duplicate comments:
In @.github/workflows/pull_request.yml:
- Around line 9-17: The pull_request workflow's paths list (pull_request.paths)
omits workflow files so changes to CI YAML can bypass the job; update the paths
array to include the workflow directory pattern ".github/workflows/**" (in
addition to the existing entries like "deny.toml") so edits to workflow files
will trigger the pull_request workflow.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 7ce2126f-9805-43d3-89d6-cb7b5ea64928

📥 Commits

Reviewing files that changed from the base of the PR and between e78c3c0 and 1a001c9.

📒 Files selected for processing (3)

.github/workflows/main.yml
.github/workflows/pull_request.yml
deny.toml

✅ Files skipped from review due to trivial changes (1)

deny.toml

dyc3 · 2026-03-22T12:28:36Z

It appears that boa uses paste

cargo tree -i paste
paste v1.0.15 (proc-macro)
├── boa_engine v0.21.0
│   └── biome_js_runtime v0.0.1 (/home/carson/Documents/code/other/biome/crates/biome_js_runtime)
└── boa_string v0.21.0
    ├── boa_ast v0.21.0
    │   ├── boa_engine v0.21.0 (*)
    │   └── boa_parser v0.21.0
    │       └── boa_engine v0.21.0 (*)
    ├── boa_engine v0.21.0 (*)
    └── boa_gc v0.21.0
        ├── boa_engine v0.21.0 (*)
        └── boa_interner v0.21.0
            ├── boa_ast v0.21.0 (*)
            ├── boa_engine v0.21.0 (*)
            └── boa_parser v0.21.0 (*)

ematipico · 2026-03-22T12:44:59Z

Maybe it's too soon to add deny for paste, unless it's possible to configure deny to check only our direct dependencies.

dyc3 · 2026-03-22T12:48:32Z

Yeah, seems to be an open issue for cargo-deny EmbarkStudios/cargo-deny#662

Went ahead and made this PR anyway: boa-dev/boa#5223

dyc3 force-pushed the dyc3/cargo-deny branch from 1e50c04 to dd923cb Compare March 21, 2026 20:35

coderabbitai bot reviewed Mar 21, 2026

View reviewed changes

.github/workflows/pull_request.yml Show resolved Hide resolved

dyc3 force-pushed the dyc3/cargo-deny branch from dd923cb to 0bc11c6 Compare March 21, 2026 20:44

ematipico approved these changes Mar 21, 2026

View reviewed changes

siketyan approved these changes Mar 22, 2026

View reviewed changes

dyc3 force-pushed the dyc3/cargo-deny branch from 0bc11c6 to e78c3c0 Compare March 22, 2026 12:14

ci: add cargo-deny for paste crate

1a001c9

dyc3 force-pushed the dyc3/cargo-deny branch from e78c3c0 to 1a001c9 Compare March 22, 2026 12:20

coderabbitai bot reviewed Mar 22, 2026

View reviewed changes

chore: run tool directly

609f7c6

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

ci: add cargo-deny for `paste` crate#9579

ci: add cargo-deny for `paste` crate#9579
dyc3 wants to merge 2 commits intomainfrom
dyc3/cargo-deny

dyc3 commented Mar 21, 2026

Uh oh!

changeset-bot bot commented Mar 21, 2026 •

edited

Loading

Uh oh!

coderabbitai bot commented Mar 21, 2026 •

edited

Loading

Reviews paused

Uh oh!

coderabbitai bot left a comment

Uh oh!

Uh oh!

coderabbitai bot left a comment

Uh oh!

dyc3 commented Mar 22, 2026

Uh oh!

ematipico commented Mar 22, 2026

Uh oh!

dyc3 commented Mar 22, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

dyc3 commented Mar 21, 2026

Summary

Test Plan

Docs

Uh oh!

changeset-bot bot commented Mar 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

coderabbitai bot commented Mar 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviews paused

Walkthrough

Possibly related PRs

Suggested reviewers

Uh oh!

coderabbitai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

coderabbitai bot left a comment

Choose a reason for hiding this comment

Uh oh!

dyc3 commented Mar 22, 2026

Uh oh!

ematipico commented Mar 22, 2026

Uh oh!

dyc3 commented Mar 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

changeset-bot bot commented Mar 21, 2026 •

edited

Loading

coderabbitai bot commented Mar 21, 2026 •

edited

Loading

dyc3 commented Mar 22, 2026 •

edited

Loading