cono

[jew256]

Note

High Risk
Large breaking release: workspace split, feature/API renames, and publish workflow that mutates default-branch versions—high impact for downstream crates and release correctness.

Overview
Major architectural refactor that turns the monolithic mavlink crate into a Cargo workspace (mavlink, mavlink-core, mavlink-bindgen), bumps Rust/edition expectations (workspace rust-version 1.85, edition 2024), and relocates the MAVLink XML submodule to mavlink/mavlink.

Codegen moves out of the root build/ scripts into mavlink-bindgen (library + optional CLI), with richer generation: dialect-* feature gates, mavlink_core types, deprecations/superseded metadata, extensions/signing-related hooks, snapshot tests, and updated dialect feature naming in docs/CI.

CI and release are reworked: Dependabot for Cargo and Actions; test.yml splits into fmt, Clippy, per-dialect test matrix (via scripts/list_dialect_features.py), MSRV checks (cargo-hack), cross-target builds using dialect-ardupilotmega, embedded size job, and docs deploy to GitHub Pages on master. Tag deploy uses cargo-workspaces to bump versions, publishes all three crates to crates.io, and pushes version commits to the default branch (replacing katyo/publish-crates).

Supporting changes include expanded README / MAINTAINERS.md, .gitignore updates, and removal of the old in-tree build pipeline.

^{Reviewed by Cursor Bugbot for commit 8c37663. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Version force pattern skips mavlink

High Severity

The cargo workspaces version command's --force "mavlink-*" argument incorrectly excludes the mavlink crate, while including mavlink-core and mavlink-bindgen. This prevents the mavlink package from receiving version updates, causing it to publish stale versions or fail during the coordinated workspace release.

 

^{Reviewed by Cursor Bugbot for commit 90bde67. Configure here.}

[cursor]

Deploy still uses set-output

High Severity

The deploy.yml workflow uses the deprecated ::set-output command for tag version extraction. This can leave steps.get_version.outputs.version empty, causing cargo workspaces version custom and cargo publish to run with an invalid release version.

 

^{Reviewed by Cursor Bugbot for commit 90bde67. Configure here.}

[cursor]

Deploy publishes default branch, not tag

High Severity

The deploy workflow is triggered by version tags but checks out github.event.repository.default_branch instead of the tagged commit. Previously, a tag push checked out that tag. Crates can now be published from newer or unrelated default-branch tip code while using only the tag name as the version string.

 

^{Reviewed by Cursor Bugbot for commit 90bde67. Configure here.}

[cursor]

Enum auto-increment skips zero

High Severity

When an enum entry has no explicit value, the generator does cnt += 1 before using cnt, so the first implicit value is 1 instead of 0. MAVLink assigns omitted values starting at 0, so generated discriminants disagree with the wire protocol and other implementations.

 

^{Reviewed by Cursor Bugbot for commit 90bde67. Configure here.}

[cursor]

Release push lacks write permission

Medium Severity

The deploy job pushes version-bump commits to the default branch with the default GITHUB_TOKEN, but the workflow never sets permissions: contents: write. On repositories with the default read-only token policy, the final git push fails after crates may already have been published.

 

^{Reviewed by Cursor Bugbot for commit 90bde67. Configure here.}

[cursor]

Crate publish race on crates.io

High Severity

mavlink-core, mavlink-bindgen, and mavlink are published back-to-back with no wait for crates.io indexing. Downstream publishes often fail because freshly uploaded dependencies are not resolvable yet, so tag releases can partially succeed and leave the workspace half-published.

 

^{Reviewed by Cursor Bugbot for commit 34958aa. Configure here.}

[cursor]

Enum merge panics on duplicates

Medium Severity

The MavEnum::try_combine function has issues merging enum entries from included dialects. It panics on missing optional values and when encountering identical entries. It also incorrectly appends same-name entries with different values, which can lead to duplicate Rust variants.

 

^{Reviewed by Cursor Bugbot for commit 34958aa. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

There are 8 total unresolved issues (including 7 from previous reviews).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want reviews to match your repository better? Bugbot Learning can learn team-specific rules from PR activity. A team admin can enable Learning in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit 7d31e4a. Configure here.}