New cargo package files checking algorithm #311

katyo · 2021-09-14T18:31:21Z

Refusing octokit in favor of ~~retrieving info from local clone of repo~~ comparing package contents with published crate
Fine grained checking updates of package files

Rationale

Sometimes developers make changes of crate code but forget update the version number in manifest. This is dangerous case when publishing dependent packages because may rise inconsistency when depended package non-backward compatible with dependency.

Current implementation:

We get last modification time of package directory via Octokit API as a last commit date when directory contents was changed.
If last modification time later than crate publishing time we stop publishing process and return the error.

Proposed implementation:

We get contents of published crate of corresponding version from registry.
We compare files from published crate with current source files. If at least one file does not match we stop publishing and return the error.

…gin-jest-24.2.0 Bump eslint-plugin-jest from 24.1.9 to 24.2.0

…-14.14.33 Bump @types/node from 14.14.32 to 14.14.33

Bumps [eslint-plugin-jest](https://github.com/jest-community/eslint-plugin-jest) from 24.2.0 to 24.2.1. - [Release notes](https://github.com/jest-community/eslint-plugin-jest/releases) - [Changelog](https://github.com/jest-community/eslint-plugin-jest/blob/main/CHANGELOG.md) - [Commits](jest-community/eslint-plugin-jest@v24.2.0...v24.2.1) Signed-off-by: dependabot[bot] <support@github.com>

…gin-jest-24.2.1 Bump eslint-plugin-jest from 24.2.0 to 24.2.1

Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) from 14.14.33 to 14.14.34. - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Signed-off-by: dependabot[bot] <support@github.com>

Bumps [eslint](https://github.com/eslint/eslint) from 7.21.0 to 7.22.0. - [Release notes](https://github.com/eslint/eslint/releases) - [Changelog](https://github.com/eslint/eslint/blob/master/CHANGELOG.md) - [Commits](eslint/eslint@v7.21.0...v7.22.0) Signed-off-by: dependabot[bot] <support@github.com>

Bump eslint from 7.21.0 to 7.22.0

…-14.14.34 Bump @types/node from 14.14.33 to 14.14.34

Bumps [eslint-plugin-jest](https://github.com/jest-community/eslint-plugin-jest) from 24.2.1 to 24.3.1. - [Release notes](https://github.com/jest-community/eslint-plugin-jest/releases) - [Changelog](https://github.com/jest-community/eslint-plugin-jest/blob/main/CHANGELOG.md) - [Commits](jest-community/eslint-plugin-jest@v24.2.1...v24.3.1) Signed-off-by: dependabot[bot] <support@github.com>

…gin-jest-24.3.1 Bump eslint-plugin-jest from 24.2.1 to 24.3.1

Bumps [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser) from 4.17.0 to 4.18.0. - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/master/packages/parser/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v4.18.0/packages/parser) Signed-off-by: dependabot[bot] <support@github.com>

Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) from 14.14.34 to 14.14.35. - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Signed-off-by: dependabot[bot] <support@github.com>

…-14.14.35 Bump @types/node from 14.14.34 to 14.14.35

…-eslint/parser-4.18.0 Bump @typescript-eslint/parser from 4.17.0 to 4.18.0

Bumps [eslint-plugin-jest](https://github.com/jest-community/eslint-plugin-jest) from 24.3.1 to 24.3.2. - [Release notes](https://github.com/jest-community/eslint-plugin-jest/releases) - [Changelog](https://github.com/jest-community/eslint-plugin-jest/blob/main/CHANGELOG.md) - [Commits](jest-community/eslint-plugin-jest@v24.3.1...v24.3.2) Signed-off-by: dependabot[bot] <support@github.com>

…gin-jest-24.3.2 Bump eslint-plugin-jest from 24.3.1 to 24.3.2

Bumps [ts-jest](https://github.com/kulshekhar/ts-jest) from 26.5.3 to 26.5.4. - [Release notes](https://github.com/kulshekhar/ts-jest/releases) - [Changelog](https://github.com/kulshekhar/ts-jest/blob/master/CHANGELOG.md) - [Commits](kulshekhar/ts-jest@v26.5.3...v26.5.4) Signed-off-by: dependabot[bot] <support@github.com>

Bumps [@types/jest](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/jest) from 26.0.20 to 26.0.21. - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/jest) Signed-off-by: dependabot[bot] <support@github.com>

…-26.0.21 Bump @types/jest from 26.0.20 to 26.0.21

….5.4 Bump ts-jest from 26.5.3 to 26.5.4

Bumps [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser) from 4.18.0 to 4.19.0. - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/master/packages/parser/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v4.19.0/packages/parser) Signed-off-by: dependabot[bot] <support@github.com>

Bumps [semver](https://github.com/npm/node-semver) from 7.3.4 to 7.3.5. - [Release notes](https://github.com/npm/node-semver/releases) - [Changelog](https://github.com/npm/node-semver/blob/master/CHANGELOG.md) - [Commits](npm/node-semver@v7.3.4...v7.3.5) Signed-off-by: dependabot[bot] <support@github.com>

Bump semver from 7.3.4 to 7.3.5

…-eslint/parser-4.19.0 Bump @typescript-eslint/parser from 4.18.0 to 4.19.0

Bumps [@actions/http-client](https://github.com/actions/http-client) from 1.0.9 to 1.0.10. - [Release notes](https://github.com/actions/http-client/releases) - [Changelog](https://github.com/actions/http-client/blob/main/RELEASES.md) - [Commits](https://github.com/actions/http-client/commits) Signed-off-by: dependabot[bot] <support@github.com>

…tp-client-1.0.10 Bump @actions/http-client from 1.0.9 to 1.0.10

fixes typo in README ("dependencies")

Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) from 14.14.35 to 14.14.36. - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Signed-off-by: dependabot[bot] <support@github.com>

Bumps [@actions/http-client](https://github.com/actions/http-client) from 1.0.10 to 1.0.11. - [Release notes](https://github.com/actions/http-client/releases) - [Changelog](https://github.com/actions/http-client/blob/main/RELEASES.md) - [Commits](https://github.com/actions/http-client/commits) Signed-off-by: dependabot[bot] <support@github.com>

Bumps [typescript](https://github.com/Microsoft/TypeScript) from 4.3.5 to 4.4.2. - [Release notes](https://github.com/Microsoft/TypeScript/releases) - [Commits](microsoft/TypeScript@v4.3.5...v4.4.2) --- updated-dependencies: - dependency-name: typescript dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [jest-circus](https://github.com/facebook/jest/tree/HEAD/packages/jest-circus) from 27.0.6 to 27.1.0. - [Release notes](https://github.com/facebook/jest/releases) - [Changelog](https://github.com/facebook/jest/blob/master/CHANGELOG.md) - [Commits](https://github.com/facebook/jest/commits/v27.1.0/packages/jest-circus) --- updated-dependencies: - dependency-name: jest-circus dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [jest](https://github.com/facebook/jest) from 27.0.6 to 27.1.0. - [Release notes](https://github.com/facebook/jest/releases) - [Changelog](https://github.com/facebook/jest/blob/master/CHANGELOG.md) - [Commits](jestjs/jest@v27.0.6...v27.1.0) --- updated-dependencies: - dependency-name: jest dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [@vercel/ncc](https://github.com/vercel/ncc) from 0.29.2 to 0.30.0. - [Release notes](https://github.com/vercel/ncc/releases) - [Commits](vercel/ncc@0.29.2...0.30.0) --- updated-dependencies: - dependency-name: "@vercel/ncc" dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) from 16.7.2 to 16.7.6. - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) --- updated-dependencies: - dependency-name: "@types/node" dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) from 16.7.6 to 16.7.8. - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) --- updated-dependencies: - dependency-name: "@types/node" dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser) from 4.29.3 to 4.30.0. - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/master/packages/parser/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v4.30.0/packages/parser) --- updated-dependencies: - dependency-name: "@typescript-eslint/parser" dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) from 16.7.8 to 16.7.10. - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) --- updated-dependencies: - dependency-name: "@types/node" dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [webpack](https://github.com/webpack/webpack) from 5.51.1 to 5.51.2. - [Release notes](https://github.com/webpack/webpack/releases) - [Commits](webpack/webpack@v5.51.1...v5.51.2) --- updated-dependencies: - dependency-name: webpack dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) from 16.7.10 to 16.7.13. - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) --- updated-dependencies: - dependency-name: "@types/node" dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser) from 4.30.0 to 4.31.0. - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/master/packages/parser/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v4.31.0/packages/parser) --- updated-dependencies: - dependency-name: "@typescript-eslint/parser" dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [jest-circus](https://github.com/facebook/jest/tree/HEAD/packages/jest-circus) from 27.1.0 to 27.1.1. - [Release notes](https://github.com/facebook/jest/releases) - [Changelog](https://github.com/facebook/jest/blob/master/CHANGELOG.md) - [Commits](https://github.com/facebook/jest/commits/v27.1.1/packages/jest-circus) --- updated-dependencies: - dependency-name: jest-circus dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [jest](https://github.com/facebook/jest) from 27.1.0 to 27.1.1. - [Release notes](https://github.com/facebook/jest/releases) - [Changelog](https://github.com/facebook/jest/blob/master/CHANGELOG.md) - [Commits](jestjs/jest@v27.1.0...v27.1.1) --- updated-dependencies: - dependency-name: jest dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) from 16.7.13 to 16.9.0. - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) --- updated-dependencies: - dependency-name: "@types/node" dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [webpack](https://github.com/webpack/webpack) from 5.51.2 to 5.52.0. - [Release notes](https://github.com/webpack/webpack/releases) - [Commits](webpack/webpack@v5.51.2...v5.52.0) --- updated-dependencies: - dependency-name: webpack dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [prettier](https://github.com/prettier/prettier) from 2.3.2 to 2.4.0. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](prettier/prettier@2.3.2...2.4.0) --- updated-dependencies: - dependency-name: prettier dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [eslint-plugin-github](https://github.com/github/eslint-plugin-github) from 4.2.0 to 4.3.0. - [Release notes](https://github.com/github/eslint-plugin-github/releases) - [Commits](github/eslint-plugin-github@v4.2.0...v4.3.0) --- updated-dependencies: - dependency-name: eslint-plugin-github dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [@vercel/ncc](https://github.com/vercel/ncc) from 0.30.0 to 0.31.0. - [Release notes](https://github.com/vercel/ncc/releases) - [Commits](vercel/ncc@0.30.0...0.31.0) --- updated-dependencies: - dependency-name: "@vercel/ncc" dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) from 16.9.0 to 16.9.1. - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) --- updated-dependencies: - dependency-name: "@types/node" dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [webpack](https://github.com/webpack/webpack) from 5.52.0 to 5.52.1. - [Release notes](https://github.com/webpack/webpack/releases) - [Commits](webpack/webpack@v5.52.0...v5.52.1) --- updated-dependencies: - dependency-name: webpack dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [typescript](https://github.com/Microsoft/TypeScript) from 4.4.2 to 4.4.3. - [Release notes](https://github.com/Microsoft/TypeScript/releases) - [Commits](microsoft/TypeScript@v4.4.2...v4.4.3) --- updated-dependencies: - dependency-name: typescript dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [jest-circus](https://github.com/facebook/jest/tree/HEAD/packages/jest-circus) from 27.1.1 to 27.2.0. - [Release notes](https://github.com/facebook/jest/releases) - [Changelog](https://github.com/facebook/jest/blob/main/CHANGELOG.md) - [Commits](https://github.com/facebook/jest/commits/v27.2.0/packages/jest-circus) --- updated-dependencies: - dependency-name: jest-circus dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

* Refusing octokit in favor of retrieving info from local clone of repo * Fine grained checking updates of package files

wangfenjin · 2021-09-19T07:15:53Z

I think it should work

https://github.com/wangfenjin/duckdb-rs/pull/23/checks?check_run_id=3643787471

katyo and others added 30 commits March 11, 2021 03:22

Merge pull request #111 from katyo/dependabot/npm_and_yarn/eslint-plu…

cb90b10

…gin-jest-24.2.0 Bump eslint-plugin-jest from 24.1.9 to 24.2.0

Merge pull request #112 from katyo/dependabot/npm_and_yarn/types/node…

a46119e

…-14.14.33 Bump @types/node from 14.14.32 to 14.14.33

Merge pull request #113 from katyo/dependabot/npm_and_yarn/eslint-plu…

60f7f3a

…gin-jest-24.2.1 Bump eslint-plugin-jest from 24.2.0 to 24.2.1

Merge pull request #116 from katyo/dependabot/npm_and_yarn/eslint-7.22.0

cde5fe6

Bump eslint from 7.21.0 to 7.22.0

Merge pull request #115 from katyo/dependabot/npm_and_yarn/types/node…

05baa7d

…-14.14.34 Bump @types/node from 14.14.33 to 14.14.34

Merge pull request #114 from katyo/dependabot/npm_and_yarn/eslint-plu…

ed102cc

…gin-jest-24.3.1 Bump eslint-plugin-jest from 24.2.1 to 24.3.1

Merge pull request #118 from katyo/dependabot/npm_and_yarn/types/node…

9379d89

…-14.14.35 Bump @types/node from 14.14.34 to 14.14.35

Merge pull request #117 from katyo/dependabot/npm_and_yarn/typescript…

b589dbc

…-eslint/parser-4.18.0 Bump @typescript-eslint/parser from 4.17.0 to 4.18.0

Merge pull request #119 from katyo/dependabot/npm_and_yarn/eslint-plu…

da29ce5

…gin-jest-24.3.2 Bump eslint-plugin-jest from 24.3.1 to 24.3.2

Merge pull request #121 from katyo/dependabot/npm_and_yarn/types/jest…

e23ceeb

…-26.0.21 Bump @types/jest from 26.0.20 to 26.0.21

Merge pull request #120 from katyo/dependabot/npm_and_yarn/ts-jest-26…

4071952

….5.4 Bump ts-jest from 26.5.3 to 26.5.4

Merge pull request #123 from katyo/dependabot/npm_and_yarn/semver-7.3.5

0829f17

Bump semver from 7.3.4 to 7.3.5

Merge pull request #122 from katyo/dependabot/npm_and_yarn/typescript…

92f5a33

…-eslint/parser-4.19.0 Bump @typescript-eslint/parser from 4.18.0 to 4.19.0

Merge pull request #124 from katyo/dependabot/npm_and_yarn/actions/ht…

e6d1f01

…tp-client-1.0.10 Bump @actions/http-client from 1.0.9 to 1.0.10

fixes typo in README ("dependencies")

31fb4d2

Merge pull request #125 from andy5995/readme-sp

ede05d2

fixes typo in README ("dependencies")

dependabot bot added 22 commits August 27, 2021 23:07

katyo mentioned this pull request Sep 14, 2021

Attempt to fix #151 #293

Closed

katyo force-pushed the octokit-less branch from 5381976 to 0bb91d3 Compare September 14, 2021 18:57

katyo added 2 commits September 15, 2021 10:55

New cargo package files checking algorithm

16ed777

* Refusing octokit in favor of retrieving info from local clone of repo * Fine grained checking updates of package files

Updated dependencies

87e7947

katyo force-pushed the octokit-less branch from 0bb91d3 to 87e7947 Compare September 15, 2021 06:02

github-actions bot closed this Dec 6, 2021

github-actions bot force-pushed the main branch from 5cb5044 to f4233ae Compare December 6, 2021 20:18

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

New cargo package files checking algorithm #311

New cargo package files checking algorithm #311

Uh oh!

katyo commented Sep 14, 2021 •

edited

Loading

Uh oh!

wangfenjin commented Sep 19, 2021

Uh oh!

Uh oh!

New cargo package files checking algorithm #311

New cargo package files checking algorithm #311

Uh oh!

Conversation

katyo commented Sep 14, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Rationale

Uh oh!

wangfenjin commented Sep 19, 2021

Uh oh!

Uh oh!

katyo commented Sep 14, 2021 •

edited

Loading