From a41c49b17f5542b1cabf87889f38d7a759acda09 Mon Sep 17 00:00:00 2001
From: Joseph Gette <joseph.gette@datadoghq.com>
Date: Tue, 3 Nov 2026 11:15:08 +0100
Subject: [PATCH] Check dependency licenses with cargo-deny in CI

Datadog's open source review requires an automated license policy. The
allow-list holds the permissive licenses the dependency graph uses
today; a crate offering several licenses passes when one is allowed.

cargo-deny is installed from crates.io at a fixed version instead of
through a third-party action, which the DataDog organization's Actions
policy may not allow. Cargo.toml now declares the crate's own license
so it is not reported as unlicensed.
---
 .github/workflows/licenses.yml | 23 +++++++++++++++++++++++
 rust/conduit/Cargo.toml        |  1 +
 rust/conduit/deny.toml         | 13 +++++++++++++
 3 files changed, 37 insertions(+)
 create mode 100644 .github/workflows/licenses.yml
 create mode 100644 rust/conduit/deny.toml

diff --git a/.github/workflows/licenses.yml b/.github/workflows/licenses.yml
new file mode 100644
index 0000000..3a487a5
--- /dev/null
+++ b/.github/workflows/licenses.yml
@@ -0,0 +1,23 @@
+name: licenses
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  cargo-deny:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+
+      - name: install cargo-deny
+        run: cargo install --locked cargo-deny@0.19.5
+
+      - name: check licenses
+        run: cargo deny --manifest-path rust/conduit/Cargo.toml check licenses
diff --git a/rust/conduit/Cargo.toml b/rust/conduit/Cargo.toml
index 37427f0..663f54d 100644
--- a/rust/conduit/Cargo.toml
+++ b/rust/conduit/Cargo.toml
@@ -4,6 +4,7 @@ version = "0.0.1-RC2"
 edition = "2024"
 rust-version = "1.93"
 description = "BEP to OpenTelemetry trace converter"
+license = "Apache-2.0"
 
 [dependencies]
 # Proto / gRPC
diff --git a/rust/conduit/deny.toml b/rust/conduit/deny.toml
new file mode 100644
index 0000000..b64a4a2
--- /dev/null
+++ b/rust/conduit/deny.toml
@@ -0,0 +1,13 @@
+# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
+# This product includes software developed at Datadog (https://www.datadoghq.com/) Copyright 2026 Datadog, Inc.
+
+# Permissive licenses only. A crate offering several licenses (e.g. "MIT OR LGPL-2.1") passes
+# when one of them is allowed.
+[licenses]
+allow = [
+    "Apache-2.0",
+    "Apache-2.0 WITH LLVM-exception",
+    "BSD-3-Clause",
+    "MIT",
+    "Unicode-3.0",
+]