cargo-deny is not an enforced merge gate in current GitHub protections
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 5.6k
- Forks
- 1.3k
- Avg merge
- 8h 47m
- Merged PRs (30d)
- 19
Description
Summary
cargo-deny runs in CI, but GitHub does not mark it as a required check for the PR merge gate. As a result, Dependabot PR automation does not enforce cargo-deny failures as a hard block.
Expected behavior
If cargo-deny is intended to enforce advisory, license, source, or ban policy, it should be a required GitHub merge check.
Actual behavior
In today’s live repo state, cargo-deny runs but is not required by GitHub’s live merge protections.
Relevant log output
From live PR #6403 on 2026-04-27:
- `cargo-deny`: `conclusion = FAILURE`
- `cargo-deny`: `isRequired = false`
Possible Solution
Add cargo-deny to the live required merge protections, or document explicitly that it is advisory-only and not part of enforcement.
Version
No response
Would you like to work on fixing this bug?
Yes
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Inspect the live GitHub merge protections and the cargo-deny check reported by PR #6403. Confirm whether cargo-deny is intended to block merges; done means it is added as a required check or the repository explicitly documents that it is advisory-only.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github, rust
- Domain
- ci-cd, devops
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100