Repository navigation
feat(release): check internal Rust crates in the production dependency check (ENG-3570) - #106
Merged
Frudrax Cheng (auroursa) merged 1 commit intoOct 10, 2026
Conversation
…y check (ENG-3570) The check read only a pnpm workspace, so a Rust source had nothing it could gate on. It now also audits a Cargo workspace: every crate Cargo.lock resolves from the owner's GitHub repositories must come from a vX.Y.Z release tag at an exact stable version, that tag must be a published release at the resolved commit, and the workspace's own declarations must pin the tag with an exact =X.Y.Z version. Verifying a release reads the crate's repository, so the action takes an optional crates-token for repositories the job token cannot read. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Frudrax Cheng (auroursa)
requested a review
from Tom Tang (qwerzl)
as a code owner
October 10, 2026 00:48
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configuration
⛔ Files ignored due to path filters (1)
📒 Files selected for processing (6)
Included review availability: This review used your included allowance. 1 included review remains after this review. Your included PR review attempts over the past 7 days set your current allowance at 3 reviews per hour. 📜 Recent review details⏰ Context from checks skipped due to timeout. (3)
🔇 Additional comments (6)
📝 WalkthroughWalkthroughThe production dependency check now supports pnpm workspaces, Cargo workspaces, or both. It validates internal Cargo crate pins against GitHub releases and combines package and crate results in its audit and report. ChangesProduction dependency audit
Priority: ➖ Normal Estimated code review effort: 3 (Moderate) | ~25 minutes Change: Feature Sequence Diagram(s)sequenceDiagram
participant Action
participant Checker
participant auditCrates
participant fetchCrateRelease
participant GitHubAPI
Action->>Checker: Set CRATES_TOKEN and run dependency check
Checker->>auditCrates: Audit Cargo inputs
auditCrates->>fetchCrateRelease: Look up repository and tag
fetchCrateRelease->>GitHubAPI: Request release and tag commit
GitHubAPI-->>fetchCrateRelease: Return release data and commit
fetchCrateRelease-->>auditCrates: Return release status and commit
auditCrates-->>Checker: Return crate records and errors
Checker-->>Action: Return combined results or errors
Merge Risk: ⚪ Minimal · up to The production dependency check now also audits internal Cargo crates alongside pnpm packages. No merge-blocking risk was identified. The action's composite steps have not yet run in Actions, so check CI before merging. Pre-merge checks |
  |
| Check name | Status | Explanation | Resolution |
|---|---|---|---|
| Docstring Coverage |  |
Docstring coverage is 64.29% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 14 functions across 3 files. (3 skipped: … | Write docstrings for the functions missing them to satisfy the coverage threshold. |
✅ Passed checks (4 passed)
| Check name | Status | Explanation |
|---|---|---|
| Description Check |  |
Check skipped - CodeRabbit’s high-level summary is enabled. |
| Title check | |
The title clearly identifies the main change: adding checks for internal Rust crates to the production dependency check. The release scope and issue reference are relevant. |
| Linked Issues check | |
Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | |
Check skipped because no linked issues were found for this pull request. |
Full details: Docstring Coverage
Explanation
Docstring coverage is 64.29% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 14 functions across 3 files. (3 skipped: 3 unsupported.)
- Fix all pre-merge checks with AI
✨ Finishing Touches 💡 1
📝 Generate docstrings 💡
- Commit to this branch
- Create a new PR
🧪 Generate unit tests (beta)
- Commit to this branch
- Create a new PR
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
I’m a rabbit with a crate to inspect,
I check every tag and pin for effect.
Through workspace paths I hop along,
Then package and crate reports join the song.
A stable release earns a bright carrot today!
Comment @coderabbitai help to get the list of available commands.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of ENG-3570
check-production-dependenciesreads a pnpm workspace and nothing else, so a Rust source has no production dependency policy to run: the action fails on the missingpnpm-workspace.yamlbefore it looks at anything. #103 gave internal crates a release (avX.Y.Ztag of their repository, with an exact crate version), and promotion already refuses a crate that depends on an unreleased one. This change applies the same rule to a source that consumes those crates.Behavior
The action audits what the selected commit has at its root: a pnpm workspace, a Cargo workspace (
Cargo.tomlwith its committedCargo.lock), or both. A commit with neither fails with a message that says so. The npm rules and the npm report are unchanged.For a Cargo workspace:
Cargo.lockwhose source is a GitHub repository of the owner must resolve from avX.Y.Ztag at an exact stable version. Arev, a branch, the default branch or a staging tag fails. Reading the lockfile covers transitive crates, as readingpnpm-lock.yamldoes for packages.Cargo.lockrecorded. A tag moved after the lockfile was written fails.workspace = trueresolved from the root manifest, and renames throughpackage) must pin the tag and an exact=X.Y.Zversion, andCargo.lockmust hold that crate at that tag and version. This is the line the release notes print and the rulecrateDependencyFindingsenforces at promotion. Dev dependencies are included here, as they are for npm.Cargo.lockthat is not version 3 or 4 fails, so a future format cannot make internal sources unrecognizable and pass.The checker reads manifests and lockfiles from Git and never runs Cargo.
Reading releases in other repositories
The job token reads only the calling repository. The new optional
crates-tokeninput is a token withcontents: readin the repositories the internal crates come from; it defaults togithub-token. The README shows minting one withactions/create-github-app-tokenand an explicit repository list, the waypublish-imagescopes its build token.GitHub answers 404 both for a tag with no release and for a private repository the token cannot read. On a 404 the checker asks for the repository itself: if that succeeds the crate is reported as Not released, otherwise as Unknown with a finding that names the missing access. Either result fails the check. A source with no internal crates makes no request and needs no token.
Report
A Cargo workspace adds its own table; a Rust-only source shows only that one.
Design notes
Cargo.tomlin the commit, not by evaluatingworkspace.membersglobs. It needs no glob or path-dependency semantics, it cannot miss a package Cargo builds, and a manifest outside the workspace (a compatibility fixture with its own lockfile) is ignored.Cargo.lockis read, as only the rootpnpm-lock.yamlis..crate. A Rust-only repository cannot adoptpackage-stageyet, so its tags are cut by its own workflow; requiring the asset would fail every consumer of such a crate. The check can be tightened once those repositories have a way in.smol-toml1.9.0, the versionpackage-releasealready pins.Compatibility
Existing callers pin the action by commit and are unaffected until they move the pin. After that, a pnpm-only source gets the same report as before. A source that has both a pnpm workspace and a root
Cargo.tomlstarts being audited for crates too.Verification
Local, on macOS with Node 24:
node --test .github/blocks/check-production-dependencies/*.test.mjs: 30 pass (20 before). The new cases cover resolved and declared pins, inheritance, renames, target tables, release states, lookup failures, a mixed source, reading a Rust-only commit from Git, and the release lookup against a stubbed API.--refagainst four Rust service repositories, with a token that can read their dependencies: two with no internal crates pass; one fails on a crate pinned byrev; one fails on a declaration without an exact version. Without a token, the crate rows are Unknown and the run fails.mainand from this branch against two pnpm service repositories: the reports are byte-identical.python3 -m unittest discover -s test: 21 pass.node --test test/*.test.mjs: 44 pass and 23 fail, the same as onmain. The failures are the crate packaging tests callingtar --format=gnu, which macOS's tar does not have; this change does not touch them, and CI runs them on Linux.The action's composite steps were not run in Actions; the first real run is the first caller that pins this commit. CI on this PR is pending.
🤖 Generated with Claude Code
Need help on this PR? Tag
@codesmith-botwith what you need. Autofix is disabled.Summary by CodeRabbit