Say what this crate may depend on, and under what terms - #34
Conversation
`deny.toml`, and the evaluation #13 asks for. `cargo deny` answers three questions no rule in `policy/principles.toml` can: whether a dependency carries a published advisory, whether its licence is one this repository may ship under, and whether the tree has acquired two copies of one crate or a source nobody named. Those are facts about the dependency graph rather than about this tree's files, which is exactly the boundary between a rule here and an external provider -- so it is adopted as a provider and not reimplemented. The four checks pass as written: advisories ok, bans ok, licences ok, sources ok. The licence list holds what the tree actually carries and nothing else, because `cargo deny` reports an allowance that matched nothing and an entry describing no dependency reads as a decision while doing nothing -- the same shape as a stale baseline or a waiver naming a rule that is gone. Three speculative entries were removed on that report. Not wired into a hook, deliberately. The advisory half reaches the network, and this repository already decided where that belongs: `no-stale-hook-pins` runs at pre-push and manual rather than at every commit, because a check that adds a network round trip to a commit is one somebody switches off. Wiring it is a separate decision, and what a claim could then name is the hook id rather than an individual advisory -- the same limit ROADMAP.md records for every third-party hook, since this tool cannot look inside one.
|
Warning Review limit reached
Next review available in: 6 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #34 +/- ##
=======================================
Coverage 89.15% 89.15%
=======================================
Files 29 29
Lines 9217 9217
=======================================
Hits 8217 8217
Misses 1000 1000 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
2 participants
The
cargo-denyhalf of #13's provider evaluation, and the config that is its evidence.Why a provider rather than a rule
cargo denyanswers three questions no rule inpolicy/principles.tomlcan: whether a dependency carries a published advisory, whether its licence is one this repository may ship under, and whether the tree has acquired two copies of one crate or a source nobody named. Those are facts about the dependency graph rather than about this tree's files, which is exactly the boundary between a rule here and an external provider. So it is adopted, not reimplemented.What it says today
The licence list holds what the tree actually carries and nothing else.
cargo denyreports an allowance that matched nothing, and an entry describing no dependency reads as a decision while doing nothing -- the same shape as a stale baseline or a waiver naming a rule that is gone. Three speculative entries were removed on that report, which is the tool doing to this config what this repository does to its own.Not wired into a hook
Deliberately, and for a reason already settled here: the advisory half reaches the network, and
no-stale-hook-pinsruns at pre-push and manual rather than at every commit because a check that adds a network round trip to a commit is one somebody switches off.Wiring it is a separate decision. What a claim in
policy/upheld.tomlcould name once it is wired is the hook id, not an individual advisory -- the same limitROADMAP.mdrecords for every third-party hook, since this tool cannot look inside one. That limit is the real finding of the provider evaluation, and it applies identically tozizmorand toast-grep.