Use cargo-deny to prevent extra crates being pulled into the build ba…

…ckend

.github/workflows/build-binaries.yml

@@ -301,7 +301,7 @@ jobs:
         with:
           target: ${{ matrix.target }}
           manylinux: auto
-          args: --profile minimal-size --locked --out dist --features self-update
+          args: --release --locked --out dist --features self-update
           # See: https://github.com/sfackler/rust-openssl/issues/2036#issuecomment-1724324145
           before-script-linux: |
             # If we're running on rhel centos, install needed packages.

.github/workflows/ci.yml

@@ -107,6 +107,10 @@ jobs:
       - uses: Swatinem/rust-cache@v2
         with:
           save-if: ${{ github.ref == 'refs/heads/main' }}
+      - uses: EmbarkStudios/cargo-deny-action@v1
+        command: check bans
+        with:
+          manifest-path: crates/uv-build/Cargo.toml
       - name: "Install Rust toolchain"
         run: rustup component add clippy
       - name: "Clippy"

crates/uv-build/deny.toml

@@ -0,0 +1,8 @@
+[bans]
+multiple-versions = "allow"
+deny = [
+  { crate = "rustls", reason = "The build backend does not need network access" },
+  { crate = "openssl", reason = "The build backend does not need network access" },
+  { crate = "reqwest", reason = "The build backend does not need network access" },
+  { crate = "schemars", reason = "JSON Schema generation is a development feature, not a runtime feature" },
+]