Add Cargo package autodiscovery

[loispostula]

Implement cargo package auto-discovery

Dependson:

• Support autodiscovery of private crates
• Support autodiscovery of crate specifying their version inline

Support autodiscovery of crate specifying their version inline

Cargo dependencies can be specified in two ways:

[dependencies]
rand = "0.1.0"

or

[dependencies]
[dependencies.rand]
version = "0.1.0"

Due to limitation in the current toml parsing capabilities, it's not possible to perform such complex queries on the Cargo.toml files. This means that autodiscovery will not work for dependencies not specifies using the full spec

Test

To test this pull request, you can run the following commands:

cd pkg/plugins/autodiscovery/cargo
go test

Additional Information

Tradeoff

Potential improvement

• Allow to restrict version update to a specific type such as only major/minor/patch update e if semver is used
• Target executing ``cargo generate-lockfilein dry-run mode shouldn't not change the fileCargo.lock`
• Leverage google/osv.dev to detect CVEs

[olblak]

Due to limitation in the current toml parsing capabilities, it's not possible to perform such complex queries on the Cargo.toml files. This means that autodiscovery will not work for dependencies not specifies using the full spec

Do you have example of queries that do no work?
Because the two example that you provide are working.

sources:
  example1:
    kind: toml
    spec:
      file: '/tmp/example2.toml'
      key: 'dependencies.rand'

  example2:
    kind: toml
    spec:
      file: '/tmp/example.toml'
      key: 'dependencies.rand.version'

[olblak]

I made some comments and spot some breaking changes that should be avoided

[loispostula]

I've update according to the review, I think the remaining items are:

• Is it ok to provide all scmid
• Should we move the test repos to an updateclitest org
• Deprecation and cargo manifest upgrade changes. I've implemented those in the New resource code.

[loispostula]

@olblak Thanks for #1071 and #1067

I've added thoses key to the manifest, I also add to make sure that the shell resource inherited the path environment variable. And it's now working fine

[olblak]

I'll run some tests over the weekend

[olblak]

@loispostula In my last commit, I disable updating the Cargo.toml if it's not strict semver. So 1.0.0 should be updated to >=1.0.0 while "1.0" should only update "Cargo.lock" by running cargo generate-lockfile

I have mixed feeling about overidding version constraint in Cargo.toml (and I am open for discussion)

[ghost]

👇 Click on the image for a new way to code review

• Make big changes easier — review code in small groups of related files

• Know where to start — see the whole change at a glance

• Take a code tour — explore the change with an interactive tour

• Make comments and review — all fully sync’ed with github

  Try it now!

Legend