Skip to content

Add cargo-machete workflow #538

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
KooshaPari merged 1 commit into from
Apr 27, 2026
Merged

Add cargo-machete workflow #538

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 24 additions & 0 deletions .github/workflows/cargo-machete.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
name: Cargo Machete

on:
push:
pull_request:

@cursor cursor Bot Apr 27, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Push trigger lacks branch filter causing duplicate runs

Medium Severity

The push trigger has no branch filter, so the workflow fires on every push to every branch. Combined with the unfiltered pull_request trigger, every PR push produces two duplicate runs. Every other workflow in this repo (cargo-deny.yml, rust-ci.yml, ci.yml, codespell.yml) scopes push to branches: [main]. This inconsistency wastes CI minutes on every single push.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit a87c272. Configure here.

schedule:
- cron: "0 3 * * 1"
workflow_dispatch:

permissions:
contents: read

jobs:
detect-unused-dependencies:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4

@cursor cursor Bot Apr 27, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Checkout action version inconsistent with rest of repo

Low Severity

This workflow uses actions/checkout@v4, while every other workflow in the repository uses actions/checkout@v6. This is inconsistent and means this workflow misses any bug fixes, performance improvements, or security patches included in v5 and v6.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit a87c272. Configure here.


- uses: taiki-e/install-action@v2
with:
tool: cargo-machete

@cursor cursor Bot Apr 27, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Install action uses mutable tag instead of pinned hash

Medium Severity

This workflow references taiki-e/install-action@v2 using a mutable tag. Every other usage of this action in the repository pins it to a specific commit hash (@44c6d64aa62cd779e873306675c7a58e86d6d532). Using a mutable tag is a supply-chain risk — the tag can be moved to point at different code without notice, potentially allowing arbitrary code execution in CI.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit a87c272. Configure here.


- name: Run cargo machete
run: cargo machete .

@cursor cursor Bot Apr 27, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Redundant unused-dependency check duplicates existing cargo-shear job

Medium Severity

This workflow adds cargo-machete to detect unused Rust dependencies, but the repository already runs cargo-shear (a tool with the same purpose) in .github/workflows/rust-ci.yml under the cargo_shear job. Running two competing tools for the same analysis is redundant and may produce conflicting or confusing CI signals.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit a87c272. Configure here.

Loading