Organization search

--organization scans the default branch of every repository of a GitHub organization or user and compares their crates with each other. No local workspace is needed.

cargo echoes --organization my-org --functions --context-blocks
cargo echoes --organization --functions
cargo echoes --organization my-org --organization other-org --functions
cargo echoes --repository my-org/app --repository someone/lib --functions
cargo echoes --organization my-org --repository someone/lib --functions

Repositories

The scan lists every repository the GH_TOKEN or GITHUB_TOKEN credential can read, private ones included. A user account lists its private repositories only when the credential belongs to that user, and its public ones otherwise. Without a name the scan targets the owner of the current repository, read from GITHUB_REPOSITORY_OWNER or the github.com URL of the origin remote. Repeating --organization joins several owners into one corpus.

--repository OWNER/REPO scans a named repository, whoever owns it. Repeat it once per repository. Alone it lists no owner, and beside --organization it adds repositories from outside those owners, each repository scanned once. A malformed name or a repository the credential cannot read leaves coverage incomplete.

Each repository is pinned to the full commit of its default branch and downloaded as a source archive. An empty repository is analyzed with no packages. Snapshots are cached per commit under organization/ in the echoes cache directory, which --context-cache-dir moves. --exclude globs match each repository's own paths, and an owner/repo: prefix limits one to that repository, as Configuration explains.

Comparison

Every Cargo package found in the snapshots joins one corpus, and the doctest, function and context checks run across it. Functions compare across crates and modules, so one function copied into two crates forms one group, and a file several crates share through #[path] counts once. Copies in different crates or modules get the helper-or-macro or generic-or-macro remedy, never delete or merge-cfg. Doc includes resolve only inside their own repository.

-p <NAME> restricts the scan to packages of that name, and fails when a completely analyzed organization has none. Dependency search is unavailable, and a nonzero --context-dependency-depth is an error.

Untrusted sources

Downloaded repositories never configure the scan or run code. Their .echoes.toml, Cargo configuration and toolchain files are ignored, and Cargo only reads their manifests, offline. Pass options on the command line or with --config <PATH>. Archive links that leave the snapshot are skipped and reported.

Report

Text output adds the repository and package counts to the summary line, then one source line per package with findings, naming its repository, commit and manifest. --json adds an organization object.

Field	Holds
name	The organization or user, empty when the scanned repositories belong to several owners
repositories	Each repository's name and pinned commit, absent when empty or unresolved
packages	Each package's repository index, name and repository-relative manifest
file_packages	The package indices owning each file with findings
coverage	complete and the failures preventing it

A repository that cannot be listed, pinned, downloaded, extracted or discovered leaves coverage incomplete. Each failure prints as an echoes: incomplete organization analysis line, and the exit status is 2, even with --no-fail.