Add cargo-deny license policy check

.github/workflows/ci.yml

@@ -31,6 +31,21 @@ jobs:
       - name: Check third-party license inventory
         run: make check-licenses
 
+  license-policy:
+    name: License Policy
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - name: Install toolchain
+        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
+        with:
+          toolchain: stable
+      - name: Cache build artifacts
+        uses: Swatinem/rust-cache@42dc69e1aa15d09112580998cf2ef0119e2e91ae # v2
+      - name: Check dependency license policy
+        run: make check-deny
+
   test:
     name: Test
     runs-on: windows-2022

Makefile

@@ -6,8 +6,10 @@
 .DEFAULT_GOAL := help
 
 export CARGO_TOOL_VERSION_dd-rust-license-tool ?= 1.0.6
+export CARGO_TOOL_VERSION_cargo-deny ?= 0.18.9
 export CARGO_BIN_DIR := $(shell echo "$${HOME}/.cargo/bin")
 DD_RUST_LICENSE_TOOL := $(CARGO_BIN_DIR)/dd-rust-license-tool
+CARGO_DENY := $(CARGO_BIN_DIR)/cargo-deny
 
 .PHONY: help
 help:
@@ -17,6 +19,7 @@ help:
 	@printf "  %-20s %s\n" "test" "Run the test suite"
 	@printf "  %-20s %s\n" "sync-licenses" "Regenerate LICENSE-3rdparty.csv"
 	@printf "  %-20s %s\n" "check-licenses" "Verify LICENSE-3rdparty.csv is up to date"
+	@printf "  %-20s %s\n" "check-deny" "Check dependency licenses with cargo-deny"
 
 .PHONY: cargo-install-dd-rust-license-tool
 cargo-install-dd-rust-license-tool:
@@ -25,6 +28,13 @@ cargo-install-dd-rust-license-tool:
 		cargo install "dd-rust-license-tool@$(CARGO_TOOL_VERSION_dd-rust-license-tool)"; \
 	fi
 
+.PHONY: cargo-install-cargo-deny
+cargo-install-cargo-deny:
+	@if [ ! -x "$(CARGO_DENY)" ] || ! "$(CARGO_DENY)" --version 2>/dev/null | grep -q "$(CARGO_TOOL_VERSION_cargo-deny)"; then \
+		echo "[*] Installing cargo-deny $(CARGO_TOOL_VERSION_cargo-deny)..."; \
+		cargo install "cargo-deny@$(CARGO_TOOL_VERSION_cargo-deny)"; \
+	fi
+
 .PHONY: fmt
 fmt:
 	@echo "[*] Checking Rust source code formatting..."
@@ -49,3 +59,8 @@ sync-licenses: cargo-install-dd-rust-license-tool
 check-licenses: cargo-install-dd-rust-license-tool
 	@echo "[*] Checking if third-party license file is up to date..."
 	@"$(DD_RUST_LICENSE_TOOL)" check
+
+.PHONY: check-deny
+check-deny: cargo-install-cargo-deny
+	@echo "[*] Checking dependency licenses with cargo-deny..."
+	@"$(CARGO_DENY)" check licenses

deny.toml

@@ -0,0 +1,23 @@
+# Unless explicitly stated otherwise all files in this repository are licensed under the MIT License.
+#
+# This product includes software developed at Datadog (https://www.datadoghq.com/)
+# Copyright 2026 Datadog, Inc.
+
+[licenses]
+version = 2
+allow = [
+  "Apache-2.0",
+  "Apache-2.0 WITH LLVM-exception",
+  "BSD-3-Clause",
+  "ISC",
+  "MIT",
+  "MIT-0",
+  "Unicode-3.0",
+]
+
+[bans]
+multiple-versions = "allow"
+
+[sources]
+unknown-registry = "deny"
+unknown-git = "deny"