GitHub Action

The dejadoc action installs cargo dejadoc, scans the workspace and reports what it finds. It can review a pull request, gate a push or find reusable code in the workspace's dependencies.

Reviewing pull requests

on: pull_request
jobs:
  dejadoc:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: LucaCappelletti94/cargo-dejadoc@v1
        with:
          pr-number: ${{ github.event.pull_request.number }}
          functions: true

With pr-number set, the action posts a review on the pull request instead of failing the job. Each copy that can go gets an inline comment with a suggestion that removes it and a link to the copy that stays. The review covers only the duplicates the pull request introduces. Set only-new: false to report older ones too.

Context and reuse findings follow the same filter and post as plain comments without removal suggestions. They do not trigger a request for changes. An extraction candidate with a verified GitHub source range can link a prefilled issue form, which creates nothing until someone submits it. A verified tagged request for the same range is linked when established.

The job summary includes scan results, and workflow annotations can show findings without a token. Set annotations: false to omit annotations.

Gating a push

Leave out pr-number and the job fails whenever it finds a duplicate, including a local context group. That suits a push to main or a scheduled run. Dependency reuse findings fail the gate only with context-fail-on-reuse: true, and a requested dependency analysis that could not complete fails the run in either mode.

Finding reuse in dependencies

A nonzero context-dependency-depth indexes the sources of the workspace's dependencies and matches local contexts against them. The job summary lists the whole reuse report in both modes, and a review posts neutral comments on the local contexts in the pull request diff. Dependency reuse explains the candidates and their actions, and Performance measures the cost.

on: push
jobs:
  dejadoc:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - name: Build dejadoc from the same commit
        run: cargo install --git https://github.com/LucaCappelletti94/cargo-dejadoc.git --rev 1e9c6ec23582e4c87c9c36413060b2fedc7a095f --locked dejadoc
      - uses: LucaCappelletti94/cargo-dejadoc@1e9c6ec23582e4c87c9c36413060b2fedc7a095f
        with:
          install: false
          context-dependency-depth: 1
          context-fail-on-reuse: true

The Action and binary in this example use the same pinned source revision. install: false retains that binary for the scan.

With a nonzero depth, the run restores the public dependency cache before scanning and saves it after complete analysis. Its key includes runner OS and context-target. The public cache contains canonical indexes, archives and extracted published sources. Path, Git, alternate-registry and modified-source entries stay private. Cache saves are skipped for incomplete analysis and fork pull requests.

Inputs

Input	Default	Effect
pr-number	empty	Review this pull request instead of failing the job
only-new	true	In a review, report only duplicates the pull request introduces
threshold	2	Report groups with at least this many sites
min-tokens	0	Skip smaller doctests
functions	false	Run the function check
fn-min-tokens	empty	Skip smaller function bodies, 30 when empty
context-blocks	false	Run the context check
context-min-tokens	empty	Skip smaller contexts, 30 when empty
context-select	empty	Local contexts whose matches are reported
context-search	empty	Contexts compared against the local selection
context-dependency-depth	0	Match local contexts against dependency sources up to this edge distance, zero stays local
context-dev-dependencies	false	Include development dependency edges
context-build-dependencies	false	Include build dependency edges
context-all-optional-dependencies	false	Explore optional edges outside the selected features
context-features	empty	Comma-separated Cargo features for discovery
context-all-features	false	Enable every workspace feature for discovery
context-no-default-features	false	Disable default workspace features for discovery
context-target	empty	Target triple used for discovery
context-cache-dir	empty	Dependency index directory, run-local when empty
context-check-latest	true	Compare each dependency against its latest published release too
context-fail-on-reuse	false	Fail the gate on dependency reuse findings
all-targets	false	Scan binary and example doctests too
package	empty	Scan one workspace member
cwd	repository root	Scan the workspace in this directory
annotations	true	Emit workflow annotations
dry-run	false	Write the review to the job summary instead of posting it
install	true	Install dejadoc, or use the cargo dejadoc already on the path
version	latest	The dejadoc version to install
mode	review	review, or prepare and post for forks
payload	empty	Directory that prepare writes and post reads

The action installs a prebuilt binary on Linux, macOS and Windows runners and builds from source anywhere else. A .dejadoc.toml in the scanned workspace sets everything the inputs leave out, such as scan-generated. threshold and min-tokens always come from the inputs.

Pull requests from forks

A pull request from a fork runs with a read-only token, so the action cannot post a review from that job. It still writes the job summary and the annotations.

To review forks too, split the work in two workflows. The first runs on the pull request with mode: prepare and uploads the rendered review as an artifact. The second runs on workflow_run with mode: post, downloads the artifact and posts it with a write token. Both workflows are in examples/workflows.

The posting workflow holds a write token while a stranger's pull request is in play, so it must never check out or run the pull request's code. It only reads the prepared payload, which carries the pull request number, the head commit and the rendered comments, including the neutral context and reuse entries. GitHub's guide on workflow_run explains the risk.