Skip to content

v0.2.0

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 15 Jun 09:21
v0.2.0
f2190d9

rust-doctor 0.2.0 is the largest release since the project went public — 31 commits spanning a new autofix engine, a workspace-deadlock fix, sharper diagnostics, and a hardened supply chain. npm packages are now published with Trusted Publishing (OIDC) and signed provenance attestations — no long-lived tokens anywhere in the pipeline.

Highlights

  • Autofix. rust-doctor can now apply machine-applicable fixes to your source, not just report them — turning diagnostics into one-command cleanups.
  • Workspace deadlock fixed. Scanning a workspace with more members than CPU cores could deadlock. Scan-root parallelism is now bounded by available OS threads.
  • Fewer false positives. The hardcoded-secrets rule is now gated on value entropy and shape, and skips test code — far less noise on real codebases.
  • Signed, tokenless publishing. Every npm artifact ships with a provenance attestation minted over OIDC. Nothing in CI holds a publishing credential.

Features

  • fixer: apply machine-applicable fixes to source files
  • scan: report per-pass timings and tracing-based logging
  • output: flag heuristic findings and clarify score / exit-code semantics
  • mcp: cancel on timeout, harden scope, and align score config
  • cli: run() extracted from main into the library, so the binary's full pipeline is reusable as a crate

Fixes & reliability

  • scan: bound scan-root parallelism with OS threads to fix the workspace deadlock
  • process: SIGKILL the whole subprocess group on timeout (no orphaned children)
  • scan: isolate the analysis target dir to avoid clobbering the project's own build
  • suppression: anchor inline suppressions to absolute path identity
  • config: reject unknown fields to catch config typos early
  • rules: gate hardcoded-secrets on value entropy/shape and skip test code
  • mcp: add pub(super) visibility to tool_router / prompt_router macros (#1) — thanks for the first community contribution

Supply chain & tooling

  • ci: npm publishing via Trusted Publishing (OIDC) + provenance, least-privilege workflow permissions, and a tag/crate-version guard
  • lints: enforce the panic/unwrap restriction lint set
  • Added rustfmt.toml, .editorconfig, issue/PR templates, security policy, and code of conduct

⚠️ Behavior changes (review before upgrading)

  • Exit-code & score semantics were clarified. If you gate CI on rust-doctor's exit code or score, re-check the thresholds against this release.
  • Unknown config keys now error. A rust-doctor.toml (or [package.metadata.rust-doctor]) with typos or stale keys that were previously ignored will now fail fast. Fix or remove unknown fields.

Install

# npm (prebuilt binary, all platforms)
npm i -g rust-doctor

# crates.io
cargo install rust-doctor

# shell installer (Linux / macOS)
curl -sL https://github.com/ArthurDEV44/rust-doctor/releases/latest/download/install.sh | bash

Full changelog: v0.1.20...v0.2.0

Assets 9
Loading