Repository navigation
feat(rust_dependency_audit): add organization rust dependency audit tool with github pages reporting - #58
Open
srinivasugithub wants to merge 7 commits into
Conversation
…ith github pages reporting
srinivasugithub
requested review from
AlexanderLanin,
MaximilianSoerenPollak,
dcalavrezo-qorix and
nradakovic
as code owners
October 8, 2026 12:32
srinivasugithub
marked this pull request as draft
October 8, 2026 12:52
There was a problem hiding this comment.
🟡 Changes recommended
Audit accuracy, incomplete repository discovery, and HTML injection risks must be addressed before deployment.
15 open findings
What changed in this PR
Adds the organization-wide Rust dependency audit requested by eclipse-score/score#1839.
Changes:
- Adds Cargo and
score-cratesparsing, auditing, and multi-format reporting. - Adds comprehensive unit tests and packaging integration.
- Adds scheduled GitHub Pages reporting and CI smoke tests.
| File | Description |
|---|---|
uv.lock |
Registers the new workspace package. |
rust_dependency_audit/tests/test_score_crates.py |
Tests reference parsing. |
rust_dependency_audit/tests/test_reporter.py |
Tests report generation. |
rust_dependency_audit/tests/test_cli.py |
Tests CLI behavior. |
rust_dependency_audit/tests/test_cargo_parser.py |
Tests Cargo parsing. |
rust_dependency_audit/tests/test_auditor.py |
Tests dependency classification. |
rust_dependency_audit/src/score_crates.py |
Parses the central crate reference. |
rust_dependency_audit/src/reporter.py |
Generates JSON, Markdown, and HTML reports. |
rust_dependency_audit/src/github_client.py |
Discovers repositories and files. |
rust_dependency_audit/src/cli.py |
Implements audit orchestration. |
rust_dependency_audit/src/cargo_parser.py |
Parses Cargo manifests and lockfiles. |
rust_dependency_audit/src/auditor.py |
Classifies and aggregates dependencies. |
rust_dependency_audit/src/__init__.py |
Defines the internal package. |
rust_dependency_audit/README.md |
Documents usage and features. |
rust_dependency_audit/pyproject.toml |
Configures packaging and CLI entry point. |
rust_dependency_audit/BUILD |
Adds Bazel targets. |
rust_dependency_audit/__main__.py |
Adds module execution support. |
rust_dependency_audit/__init__.py |
Defines the top-level package. |
README.md |
Lists the new tool. |
pyproject.toml |
Adds the workspace member. |
.gitignore |
Ignores generated outputs. |
.github/workflows/tests.yml |
Builds and smoke-tests the wheel. |
.github/workflows/rust-dependency-audit.yml |
Runs audits and deploys GitHub Pages. |
🧠 Review effort: Balanced
Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.
Comment on lines
+70
to
+71
| is_git = "git" in spec | ||
| is_path = "path" in spec |
Author
There was a problem hiding this comment.
Fixed in cargo_parser.py and auditor.py. DeclaredDependency now records git_url and git_rev. In auditor.py, _git_matches_spec() cross-references declared Git repositories and commit
revisions against ScoreCrateSpec.git and rev. Verified with unit test test_audit_git_dependencies
…iscovery, and security - score_crates: use balanced parentheses scanner ignoring comments/strings for crate.spec - cargo_parser: handle renamed dependencies (package = ...) and preserve git_url/rev - auditor: preserve version requirement operators (=, ~), track multiple lockfile versions, and verify lockfile mismatches - github_client: handle git tree truncation fallback and discover git submodule manifests - reporter: escape embedded JSON script data and sanitize DOM inputs to prevent XSS - reporter & cli: dynamically use reference_repo in reports and count non-Rust repos - cli & workflow: ensure default reports bundle is always written in out_dir and append summary separately - tests: add comprehensive test suite covering all review findings
There was a problem hiding this comment.
🟡 Changes recommended
Lockfile coverage, reference validation, parser correctness, and silent fetch failures can produce incomplete or failed audits.
7 open findings
13 resolved since last review
🧠 Review effort: Balanced
…reference validation, and scanner correctness - auditor: unconditionally merge lockfile-only crates and track resolved versions and git sources - cli: require at least one parsed crate specification in central reference - score_crates: add cycle detection in get_spec to prevent alias recursion errors - score_crates: track lexical context from index 0 to ignore specs in comments and strings - github_client: propagate REST API errors on auth, rate limit, and network failures - reporter: add persistent aria-label to search input for accessibility - tests: add unit tests for all review findings
There was a problem hiding this comment.
🟡 Changes recommended
Unresolved critical issues allow workflow command injection and can cause incorrect dependency classifications, silently incomplete reports, or aborted organization audits.
8 open issues
6 resolved since last review
Review effort: Balanced
Comment on lines
+54
to
+58
| env: | ||
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| run: | | ||
| ORG="${{ inputs.organization || 'eclipse-score' }}" | ||
| REF_REPO="${{ inputs.reference_repo || 'eclipse-score/score-crates' }}" |
Comment on lines
+123
to
+124
| _, clean_spec = _parse_requirement(spec_ver) | ||
| return res_ver.strip() == clean_spec |
Comment on lines
+220
to
+223
| if lock.name not in collected_crates: | ||
| git_urls: set[str] = set() | ||
| git_revs: set[str] = set() | ||
| if lock.source and lock.source.startswith("git+"): |
Comment on lines
+84
to
+86
| # Handle rate limiting or not found without leaking tokens | ||
| if e.code == 404: | ||
| return None |
Comment on lines
+256
to
+267
| try: | ||
| sub_entries = self._fetch_tree_entries( | ||
| sub_owner, sub_repo, sub_sha | ||
| ) | ||
| for sub_item in sub_entries: | ||
| if sub_item.get("type") == "blob": | ||
| full_sub_p = ( | ||
| f"{sub_path}/{sub_item.get('path', '')}" | ||
| ) | ||
| paths.append(full_sub_p) | ||
| except Exception: | ||
| pass |
| self, owner: str, repo: str, path: str, branch_or_sha: str | ||
| ) -> str | None: | ||
| """Helper to fetch raw file content from GitHub raw or REST API.""" | ||
| url = f"https://raw.githubusercontent.com/{owner}/{repo}/{branch_or_sha}/{path}" |
Comment on lines
+186
to
+189
| for toml in repo_data.cargo_tomls: | ||
| for dep in toml.dependencies: | ||
| # Exclude internal path dependencies | ||
| if dep.is_path or dep.name in internal_crate_names: |
Member
|
this would belong to crates repo, wouldnt it? |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR implements the Rust Dependency Audit tool and GitHub Pages reporting workflow as requested in eclipse-score/score#1839.
Context & Motivation
Across the
eclipse-scoreorganization, multiple repositories maintain Rust implementations (baselibs,kyron,lifecycle,persistency,scrample,feo, etc.). To ensure that dependencies are consistent and centrally managed ineclipse-score/score-crates(the central single source of truth), this tool automates:Cargo.tomlandCargo.lockin root, workspaces, and submodules).eclipse-score/score-crates(MODULE.bazelcrate.specandBUILDalias).MANAGED: Defined inscore-crateswith matching version.VERSION_MISMATCH: Defined inscore-crates, but repository requests a different version.UNMANAGED: Direct external crate not yet onboarded intoscore-crates.index.html): Self-contained web app with live metrics, search filter, status filter, and per-repository breakdown tables.rust_dependency_audit.json): For CI/CD automation or SBOM tools.rust_dependency_audit.md): Formatted for GitHub issue comments and Step Summaries..github/workflows/rust-dependency-audit.yml) for scheduled weekly runs and on-demand deployment to GitHub Pages.Changes
rust_dependency_auditto workspace members inpyproject.toml.rust_dependency_auditpackage withcli.py,github_client.py,cargo_parser.py,score_crates.py,auditor.py,reporter.py,BUILD, andREADME.md.test_cargo_parser.py,test_score_crates.py,test_auditor.py,test_reporter.py,test_cli.py)..github/workflows/tests.yml..github/workflows/rust-dependency-audit.yml.README.md.Testing & Validation
ruff checkandruff formatpassed with 0 errors.score-copyright.uv buildandscore-rust-dependency-audit --help.Relates to eclipse-score/score#1839