v0.2.0: API change check, new boundary rules and CRAP scores

This release adds an API change check, new boundary rules and CRAP scores. It also makes fix safer, and the GitHub Action now meets the GitHub Marketplace rules.

cargo install cargo-fallow --locked

New checks

• cargo fallow api --base <REF> reports the public API changes of each published library. It lists the added, removed and changed items, and the crates and features that were added or removed. The api-removals gate fails when an item was removed and the breaking part of the version did not change. The GitHub Action runs it with command: api and the base input.
• cargo fallow boundaries has three new rule types. Item rules keep some packages from a workspace item, also through use, aliases and re-exports. Glob re-export rules find a pub use <path>::* that reads a denied crate or module. cfg rules report a path from code that a cfg build compiles to an item that the same build does not compile.
• boundaries.sources rules take scope = "production" and allow = [{ path, max }]. The first skips test code. The second lets a listed file have up to max matches.
• cargo fallow deps has the opt-in feature-unification-drift rule. It reports a shared crate that gets other features in cargo build -p <member> than in cargo build --workspace.
• --coverage <LCOV> gives each function a CRAP score in complexity and check. A function at or over max-crap (default 30) is a complexity-crap finding.

Configuration

• cyclomatic-policy = "flat-match" counts a flat match, for example a lookup table, as one decision. The default stays standard.
• cargo fallow dupes --production and production = true leave test code out of the clone search.
• cargo fallow visibility --public-crate and the public-crates key name the libraries that are an external API. Each other library gets each rule.
• cargo fallow check accepts --base <REF> and --staged, so one check run covers the file-growth gate. The GitHub Action passes its base input to check.

cargo fallow fix

• fix formats each changed file with rustfmt when the file was formatted before the edits.
• --only <CHECK> and --skip <CHECK> limit the edits to deps or visibility.
• fix leaves out an edit that adds a compiler warning. Before, a workspace that builds with -D warnings could break after fix exited 0.

Changed behavior

• The SARIF level of a finding now follows its severity: error gives error, and warn gives warning. A gate flag no longer changes the level. A deps warning is now a SARIF warning, not a note.
• With code-duplication = "off", the duplication-threshold gate still judges the percentage. To drop the gate, remove threshold from [workspace.metadata.fallow.dupes].

Fixes

• cargo fallow visibility gives credit to intra-doc links in more forms, so fix no longer breaks cargo doc. It also no longer reports items where pub(crate) causes a rustc or clippy error: a type in the signature of a pub item, a #[cfg(test)] pub item in a private module, and an item that a use with a written visibility re-exports.
• cargo fallow deps counts an intra-doc link to a dependency as a use.
• cargo fallow mutants gives --locked, --offline and --frozen to each cargo call in the copies.
• The GitHub Action fails the step when base: auto cannot read the base commit of a gate that needs it. Before, the growth gate passed without a check.
• The GitHub Action and the GitLab template post no first comment for a clean run.
• The description of the GitHub Action now fits the Marketplace limit.

Performance

• cargo fallow check parses each file one time. On a large workspace, the run uses about 14% less CPU time.
• The memory of cargo fallow visibility now grows about linearly with the source size. On a generated 5 MB file, the peak memory goes from 8.9 GB to 1.5 GB, and the time from 33 s to 1.5 s.

v0.1.0...v0.2.0