beardthelion e9d6aadd58 ci(core): add dependency-purity allowlist gate for gitlawb-core ...

gitlawb-core is embedded by gl, git-remote-gitlawb, and the node daemon,
so it must stay lean. Add a CI gate that fails if its normal (non-dev,
non-build) transitive dependency tree gains any crate not on an explicit
allowlist.

The allowlist is exhaustive-by-construction: a new heavy dependency reds
CI whether or not anyone thought to ban it, which a denylist cannot do.
The checker resolves like the build/test jobs (no --locked, since the
committed lockfile can lag the manifests) and snapshots/restores
Cargo.lock so a local run leaves no working-tree side effects.

- ci/gitlawb-core-allowed-deps.txt: the 83 current normal deps, plus the
  regeneration command and rationale in the header
- scripts/check-gitlawb-core-deps.sh: recompute and diff; hard-fail on a
  non-allowlisted crate, note-only on a stale (removed) allowlist entry
- pr-checks.yml: new hard-fail core-deps-purity job, matching the pinned
  action SHAs and style of the sibling jobs

2026-07-22 12:04:34 -05:00

..

build-bins.sh

[codex] chore: add live-safe OSS readiness pass (#14)

2026-05-28 15:34:47 +08:00

build-macos-app.sh

feat: macOS menu bar app for managing gitlawb-node Docker Compose stack (#8)

2026-05-27 09:37:36 +08:00

check-gitlawb-core-deps.sh

ci(core): add dependency-purity allowlist gate for gitlawb-core

2026-07-22 12:04:34 -05:00