ci: enforce dependency policy

.github/workflows/supply-chain.yml

@@ -0,0 +1,23 @@
+name: Supply Chain
+
+on:
+  pull_request:
+  workflow_dispatch:
+  schedule:
+    - cron: "30 2 * * 1"
+
+permissions:
+  contents: read
+
+jobs:
+  dependency-policy:
+    name: Dependency policy
+    runs-on: ubuntu-22.04
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - name: Check advisories, licenses, bans, and sources
+        uses: EmbarkStudios/cargo-deny-action@3c6349835b2b7b196a839186cb8b78e02f7b5f25 # v2.1.1
+        with:
+          command: check
+          arguments: --all-features

AGENTS.md

@@ -9,13 +9,13 @@ Edit documentation sources under `docs/src/` and navigation in `docs/src/SUMMARY
 ## Build, Test, and Development Commands
 
 - `cargo check --all-targets` performs the required baseline compile check.
-- `cargo build` compiles the debug binary and library.
 - `cargo run -- examples/app.poo` runs a sample program.
 - `cargo test` runs unit, integration, and documentation tests.
 - `cargo fmt --all -- --check` checks formatting; `cargo fmt --all` applies it.
 - `cargo clippy --all-targets --all-features -- -D warnings` runs strict linting.
 - `mdbook build docs` is the canonical documentation build; `mdbook test docs` tests its Rust examples.
 - `dist generate --check` verifies that the generated release workflow matches its configuration.
+- `cargo deny check` enforces `DEPENDENCY_POLICY.md` for every dependency change.
 
 All established formatting, compilation, test, and lint checks must pass before review.
 

CONTRIBUTING.md

@@ -36,6 +36,7 @@ Pull requests are squash-merged only. Do not use merge commits or rebase merges.
 - [Rust](https://www.rust-lang.org/tools/install) (Edition 2024 or later)
 - [Cargo](https://doc.rust-lang.org/cargo/)
 - [mdBook 0.5.2](https://rust-lang.github.io/mdBook/guide/installation.html): `cargo install mdbook --locked --version 0.5.2`
+- [cargo-deny 0.20.2](https://embarkstudios.github.io/cargo-deny/): `cargo install --locked cargo-deny --version 0.20.2`
 
 ### Workflow
 1. **Clone your fork**:
@@ -57,9 +58,15 @@ Pull requests are squash-merged only. Do not use merge commits or rebase merges.
    mdbook build docs
    mdbook test docs
    ```
+5. **Check Dependencies**:
+   ```bash
+   cargo deny check
+   ```
 
 `mdbook build docs` is the canonical documentation build command. Before review, run all applicable commands above plus `cargo fmt --all -- --check` and `cargo clippy --all-targets --all-features -- -D warnings`; all established checks must pass.
 
+Dependency changes must follow `DEPENDENCY_POLICY.md`, update `Cargo.lock`, and pass the advisory, license, ban, and source checks without undocumented exceptions.
+
 ## Release Changes
 
 Configure releases in `dist-workspace.toml`; `.github/workflows/v-release.yml` is generated and must not be edited by hand. Run `dist generate --mode=ci` after changing release configuration and `dist generate --check` before review. Maintainers must follow `RELEASING.md`; release tags are reserved for reviewed release commits on `main`.

DEPENDENCY_POLICY.md

@@ -0,0 +1,23 @@
+# Dependency Policy
+
+PooLang keeps its dependency surface small, reproducible, and suitable for a compiled backend platform. Every dependency change follows the normal issue-first, focused pull-request workflow and must pass `cargo deny check`.
+
+## Rust Dependencies
+
+- Prefer maintained crates.io releases with the narrowest practical compatible SemVer requirement. Wildcards and unreviewed registries or Git sources are denied.
+- Commit `Cargo.lock` changes with the manifest change. Review newly resolved transitive dependencies, enabled features, build scripts, and platform-specific code.
+- An unavoidable Git dependency requires an explicit source exception in `deny.toml`, a full `rev` commit pin, and an issue explaining why no registry release is suitable.
+- Globally accepted licenses are MIT, Apache-2.0, Apache-2.0 with LLVM exception, ISC, Unicode-3.0, and Zlib. Add other licenses only as package-and-version-specific exceptions with documented review.
+- An advisory ignore must be temporary. Its reason must name the tracking issue, mitigation, owner, and expiry date; remove it as soon as a fixed dependency is available.
+
+Install the CI-pinned policy tool with `cargo install --locked cargo-deny --version 0.20.2`, then run `cargo deny check` before review.
+
+## Native Dependency Inventory
+
+No native libraries are currently linked or shipped.
+
+Before adding LLVM, Boehm GC, or another native component, record its upstream source, pinned version or commit, archive checksum or verified signature, SPDX license, static or dynamic linkage, supported targets, vulnerability advisory source, and update owner in this section. Preserve required license and notice files in source and release artifacts. The adoption issue must also explain how clean and reproducible builds obtain the dependency.
+
+## Vulnerability Response
+
+GitHub Dependabot alerts and the scheduled supply-chain workflow provide notification; dependency PRs are not automated. Triage each alert through a new issue, determine affected shipped versions, and submit the smallest compatible update or mitigation through normal review.

TODO.md

@@ -20,6 +20,8 @@ Snapshot: 2026-07-29.
 - Lexer, parser, interpreter, type-inference, examples, mdBook documentation, and cargo-dist release assets exist.
 - cargo-dist 0.31.0 generates five platform targets and shell, PowerShell, npm, Homebrew, and MSI installers from reviewed configuration.
 - Release actions use immutable commit pins, version tags are protected, and future release artifacts receive GitHub provenance attestations.
+- Rust dependencies are gated by advisory, license, version, and source policy checks across all supported targets.
+- Dependabot vulnerability alerts and a weekly supply-chain check monitor the currently dependency-free crate graph.
 
 ### Quality gaps
 
@@ -81,7 +83,7 @@ Snapshot: 2026-07-29.
 - [x] Reconcile README commands, branch names, CI claims, supported features, and examples with executable behavior.
 - [x] Add focused lexer/parser error tests for malformed strings, comments, UTF-8 input, and unexpected EOF.
 - [x] Audit release workflow actions, permissions, secrets, installers, and generated cargo-dist configuration.
-- [ ] Add dependency, license, and supply-chain checks appropriate to Rust and future native runtime dependencies.
+- [x] Add dependency, license, and supply-chain checks appropriate to Rust and future native runtime dependencies.
 - [ ] Migrate npm publishing to trusted publishing for `v-release.yml`, then revoke and remove `NPM_TOKEN`.
 - [ ] Replace or rotate the Homebrew credential with a fine-grained, tap-only Contents-write token.
 - [ ] Add platform code signing before the production v0.2 release.
@@ -195,6 +197,7 @@ Snapshot: 2026-07-29.
 - [ ] Rewrite README and mdBook around the compiled backend language and remove interpreter-era promises/examples.
 - [ ] Publish the language specification, CLI reference, standard-library reference, deployment guide, and editor setup.
 - [ ] Build signed/checksummed Linux x86_64 toolchain, runtime, and analyzer artifacts.
+- [ ] Generate a release SBOM and third-party notices when external Rust or native dependencies first ship.
 - [ ] Verify installation, compilation, HTTP example, package locking, analyzer, VS Code, and Zed from clean machines.
 - [ ] Publish v0.2.0 only when compiler, async, HTTP/JSON, package tooling, analyzer, performance, and security gates pass.
 

deny.toml

@@ -0,0 +1,40 @@
+[graph]
+all-features = true
+targets = [
+    "aarch64-apple-darwin",
+    "aarch64-unknown-linux-gnu",
+    "x86_64-apple-darwin",
+    "x86_64-unknown-linux-gnu",
+    "x86_64-pc-windows-msvc",
+]
+
+[advisories]
+unmaintained = "workspace"
+unsound = "all"
+ignore = []
+
+[bans]
+multiple-versions = "warn"
+wildcards = "deny"
+highlight = "all"
+deny = []
+skip = []
+skip-tree = []
+
+[licenses]
+include-dev = true
+confidence-threshold = 0.93
+unused-allowed-license = "allow"
+allow = [
+    "Apache-2.0",
+    "Apache-2.0 WITH LLVM-exception",
+    "ISC",
+    "MIT",
+    "Unicode-3.0",
+    "Zlib",
+]
+exceptions = []
+
+[sources]
+unknown-registry = "deny"
+unknown-git = "deny"