ci: run cargo deny on the cutile-rs workspace

.github/workflows/cargo-deny.yml

@@ -4,13 +4,18 @@ name: cargo-deny
 # Runs as a job of the top-level CI workflow (.github/workflows/ci.yml) on
 # push/pull_request, plus a standalone weekly security scan via schedule.
 # Concurrency for the CI path is governed by CI's own group.
+# ci.yml does not run for a cutile-rs-only diff. That gap is covered by
+# .github/workflows/cutile-cargo-deny.yml, which runs the cutile-rs step
+# below when the Tile lock, a Tile manifest, or cutile-rs/deny.toml changes.
 #
 # Four parts of the same concern. `check` enforces the license *policy* over
 # the whole resolved graph from deny.toml, once per `[workspace]` root that
-# resolves third-party crates and is neither an example nor under cutile-rs:
-# the stable host workspace, the SIMT workspace,
-# cuda-oxide/crates/rustc-codegen-cuda, and the cuda-macros device-only
-# fixture. Each declares its own `[workspace]`, so each is a
+# resolves third-party crates and is not an example: the stable host
+# workspace, the SIMT workspace, cuda-oxide/crates/rustc-codegen-cuda, the
+# cuda-macros device-only fixture, and cutile-rs. The cutile-rs run starts at
+# cutile-rs/Cargo.toml so it uses cutile-rs/deny.toml rather than the Oxide
+# policy. Paper benchmarks under cutile-rs/cutile-benchmarks/paper stay out.
+# Each root declares its own `[workspace]`, so each is a
 # separate resolution the others cannot reach. `license-manifest` enforces that
 # the human-readable inventory in dependency-licenses.csv still lists what the
 # workspace declares, which nothing checked before: CONTRIBUTING asks
@@ -80,18 +85,20 @@ jobs:
       # ok. (cuda-oxide/crates/fuzzer/rustlantis is another `[workspace]` root
       # and is deliberately not here: it is a vendored upstream project, not
       # first-party code, and bringing its graph under deny.toml is a policy
-      # call rather than a gap. The cutile-rs roots -- cutile-rs/Cargo.toml and
-      # the four paper benchmarks under cutile-rs/cutile-benchmarks/paper --
-      # are out for the same kind of reason: cutile-rs is a nested import of a
-      # separate product that carries its own cutile-rs/deny.toml, so Oxide's
-      # policy is not the one that judges it. To bring them in one day, add a
-      # `cargo deny --manifest-path <root> --locked check` step per root here,
-      # and drop the matching CUTILE_ROOT filter in
-      # cuda-oxide/scripts/check-dependency-licenses.sh so the inventory half
-      # covers them too.)
+      # call rather than a gap. The paper benchmarks under
+      # cutile-rs/cutile-benchmarks/paper are separate workspaces and stay
+      # out; launch_overhead_rust patches its dependencies to a path outside
+      # this tree. The license inventory still skips cutile-rs via CUTILE_ROOT
+      # in cuda-oxide/scripts/check-dependency-licenses.sh.)
       - name: Run cargo-deny over the cuda-macros device-only fixture
         run: cargo deny --manifest-path cuda-oxide/crates/cuda-macros/tests/device-only/Cargo.toml --locked check
 
+      # cutile-rs/deny.toml is a separate policy. A walk that starts at this
+      # manifest finds that file before the root deny.toml. Tile-only diffs
+      # miss ci.yml, so cutile-cargo-deny.yml runs this same command for those.
+      - name: Run cargo-deny over the cutile-rs workspace
+        run: cargo deny --manifest-path cutile-rs/Cargo.toml --locked check
+
   license-manifest:
     name: dependency-licenses.csv covers every declared crate
     runs-on: ubuntu-latest

.github/workflows/ci-status.yml

@@ -11,19 +11,23 @@ name: CI status
 # self-hosted runners, which cannot run on pull_request events, so it
 # triggers on push to main and to the copy-pr-bot mirror branches.
 #
-# This workflow runs whenever either of them completes on main. For each
+# This workflow runs whenever one of them completes on main. For each
 # pipeline it finds the newest completed push run on main that actually
 # executed jobs and fails if that run failed. Two kinds of run say nothing
 # about the pipeline and are skipped over: a run whose jobs were all skipped
 # (cutile-rs.yml's `changes` gate does that on a non-Tile push) and a
 # cancelled run. Taking either at face value would turn the badge green while
 # the last real run was red.
 #
+# cutile-cargo-deny.yml is included so a Tile lock or deny.toml failure on
+# main fails this badge. A push that does not match its path filters creates
+# no run, and the loop keeps the newest run that did.
+#
 # The badge in README.md points here. To cover another pipeline, add its
 # workflow name to the trigger list and its file name to the loop below.
 on:
   workflow_run:
-    workflows: [CI, cutile-rs-pr]
+    workflows: [CI, cutile-rs-pr, cutile-rs cargo-deny]
     types: [completed]
     branches: [main]
 
@@ -43,7 +47,7 @@ jobs:
         run: |
           set -euo pipefail
           failed=0
-          for workflow in ci.yml cutile-rs.yml; do
+          for workflow in ci.yml cutile-rs.yml cutile-cargo-deny.yml; do
             verdict=none
             url=-
             while read -r id conclusion run_url; do

.github/workflows/cutile-cargo-deny.yml

@@ -0,0 +1,64 @@
+---
+name: cutile-rs cargo-deny
+
+# ci.yml's path filters omit cutile-rs/**, and this check is a job of that
+# workflow. A pull request that only touches the Tile lock, a Tile manifest,
+# or cutile-rs/deny.toml would otherwise skip the audit. Calling the whole
+# SIMT workflow for those paths would also run fmt, clippy, and the unit
+# tests. This workflow runs the one cutile-rs command.
+#
+# pull_request is the right event: path filters see the pull request diff.
+# cutile-rs.yml cannot host this. Its runners do not accept pull_request, and
+# a path filter on the copy-pr-bot mirror push is dropped when GitHub reports
+# that push as having no changed files.
+#
+# `cutile-rs/**/Cargo.toml` does not match `cutile-rs/Cargo.toml`; `**` does
+# not consume the slash in front of it. The root manifest and lock are listed
+# on their own. Paper benchmark manifests match the same globs. This job still
+# does not audit those workspaces.
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'cutile-rs/Cargo.toml'
+      - 'cutile-rs/Cargo.lock'
+      - 'cutile-rs/**/Cargo.toml'
+      - 'cutile-rs/**/Cargo.lock'
+      - 'cutile-rs/deny.toml'
+      - '.github/workflows/cutile-cargo-deny.yml'
+  pull_request:
+    branches: [main]
+    paths:
+      - 'cutile-rs/Cargo.toml'
+      - 'cutile-rs/Cargo.lock'
+      - 'cutile-rs/**/Cargo.toml'
+      - 'cutile-rs/**/Cargo.lock'
+      - 'cutile-rs/deny.toml'
+      - '.github/workflows/cutile-cargo-deny.yml'
+
+# Each commit on main gets its own group, so it starts at once. Any other ref
+# still shares one group and cancels the older run.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref_name }}${{ github.ref_name == 'main' && format('-{0}', github.sha) || '' }}
+  cancel-in-progress: ${{ github.ref_name != 'main' }}
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    name: cargo deny over the cutile-rs workspace
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Clone repository
+        uses: actions/checkout@v4
+
+      - name: Install cargo-deny
+        run: cargo install cargo-deny --locked
+
+      # cutile-rs/deny.toml is a separate policy. A walk that starts at this
+      # manifest finds that file before the root deny.toml. --locked so a
+      # stale committed lock fails instead of being rewritten.
+      - name: Run cargo-deny over the cutile-rs workspace
+        run: cargo deny --manifest-path cutile-rs/Cargo.toml --locked check

cuda-oxide/Justfile

@@ -200,8 +200,8 @@ check-errors:
 # the naming-guard's reserved-prefix search, and all four cargo-deny jobs:
 # `cargo deny check` enforces deny.toml over each non-example `[workspace]`
 # root that resolves third-party crates -- the stable host workspace, the SIMT
-# workspace, crates/rustc-codegen-cuda, and the cuda-macros device-only
-# fixture, each of
+# workspace, crates/rustc-codegen-cuda, the cuda-macros device-only fixture,
+# and cutile-rs (its own deny.toml), each of
 # which resolves its own graph because each declares its own `[workspace]`;
 # the license inventory covers what those workspaces declare; deny.toml holds
 # over the example workspaces; and every first-party
@@ -237,6 +237,8 @@ check-guards:
     cargo deny --manifest-path crates/cargo-oxide/Cargo.toml --workspace --locked check
     cargo deny --manifest-path crates/rustc-codegen-cuda/Cargo.toml --locked check
     cargo deny --manifest-path crates/cuda-macros/tests/device-only/Cargo.toml --locked check
+    # Walk from cutile-rs/Cargo.toml so cutile-rs/deny.toml is found before the root policy.
+    cd .. && cargo deny --manifest-path cutile-rs/Cargo.toml --locked check
     bash scripts/check-dependency-licenses.sh
     bash scripts/check-example-license-policy.sh
     bash scripts/check-spdx-headers.sh