ci: enforce workspace-level dependency declarations - #2514
Draft
yannham wants to merge 1 commit into
Draft
Conversation
Contributor
🔒 Cargo Deny Results📦
|
Contributor
📚 Documentation Check Results📦
|
|
✅ All CI checks and tests passed. 🎉 All green!🧪 All tests passed 🎯 Code Coverage (details) 🔗 Commit SHA: bc0189d | Docs | View more details | Give us feedback! |
Contributor
Artifact Size Benchmark Reportaarch64-alpine-linux-musl
aarch64-unknown-linux-gnu
libdatadog-x64-windows
libdatadog-x86-windows
x86_64-alpine-linux-musl
x86_64-unknown-linux-gnu
|
yannham
force-pushed
the
ci/workspace-deps-lint
branch
from
September 11, 2026 15:26
72f03b6 to
a7186ee
Compare
BenchmarksComparisonBenchmark execution time: 2026-09-11 16:10:07 Comparing candidate commit a7186ee in PR branch Found 2 performance improvements and 12 performance regressions! Performance is the same for 162 metrics, 0 unstable metrics.
|
Add a `workspace-deps-lint` helper to the `.github/actions` CI workspace and run it from a new "Workspace dependency declarations" job in `lint.yml`. It enforces two rules: 1. every external dependency of a workspace member is declared in the root `[workspace.dependencies]` and inherited with `workspace = true`; 2. every `[workspace.dependencies]` entry is version-only, i.e. `default-features = false` and no `features`. Exceptions are per dependency and justified in a comment, clippy-allow style: rule 1 needs `# allow(workspace-deps): <justification>` directly above the dependency, rule 2 needs at least one comment line above the workspace entry explaining why every member gets that feature (which the existing `flate2`, `httpmock`, `libc`, `criterion`, `serde_json` and `tempfile` notes already provide). Path dependencies are crates of this repository and are exempt. No off-the-shelf tool covers this: cargo-autoinherit, cargo-workspace-deps and cargo-workspace-inheritance-check only handle rule 1 and have no notion of documented exceptions, and clippy has no manifest lints. The linter parses manifests with toml_edit spans so it can tie each finding to a line, and emits GitHub error annotations on top of the human-readable report. Also make the tree comply. `blazesym-c`, `cbindgen`, `kernel32-sys`, `winapi`, `windows` and `windows-sys` move to the workspace level, and members inherit them while spelling out the features they used to get from default features (`windows`' `std`, `blazesym-c`'s `dwarf`). Four declarations that genuinely cannot inherit yet are documented exceptions: `windows` 0.51 in `datadog-sidecar` and `spawn_worker`, `windows-sys` 0.48 in `libdd-ipc` and the legacy `winapi` 0.2 in `spawn_worker`. Resolved feature sets are unchanged for both the linux and windows targets, except that `build_common` no longer pulls clap in through cbindgen's default features. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
yannham
force-pushed
the
ci/workspace-deps-lint
branch
from
September 11, 2026 15:37
a7186ee to
bc0189d
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
Adds a CI check that enforces our dependency declaration policy:
[workspace.dependencies]and inherited withworkspace = true;default-features = falseand nofeatures.Exceptions are allowed per dependency, clippy-allow style: rule 1 needs a
# allow(workspace-deps): <justification>comment above the dependency, rule 2 needs a comment above the workspace entry explaining why every member gets that feature.The check is a small linter in the existing
.github/actionsCI workspace, run from a new job inlint.yml. It reports file and line, and annotates the PR diff. A handful of manifests are brought in line with the rules so the check passes.Motivation
The workspace-dependency migration is essentially done, but nothing stops it from regressing: a new crate can quietly pin its own version, and a workspace entry can quietly turn a feature on for everyone. This makes the policy checkable instead of a review convention, while keeping room for justified exceptions.
No existing tool fits — cargo-autoinherit and friends only cover rule 1 and have no notion of documented exceptions, and clippy has no manifest lints.
Additional Notes
A few pre-existing cases genuinely cannot inherit yet (Windows crates pinned to older major versions); they are documented exceptions rather than migrations, which would need a Windows build to validate. Resolved feature sets are unchanged on both Linux and Windows targets.
How to test the change?
CI: the new "Workspace dependency declarations" job must pass.
Locally:
(cd .github/actions && cargo run -p workspace-deps-lint)To see it fail, drop a dependency with its own version into any member manifest, or enable a feature on a workspace entry, and re-run.
The linter has unit tests for its own rules, run with
(cd .github/actions && cargo test -p workspace-deps-lint)when editing it. Like the other crates under.github/actions, they are not wired into CI.🤖 Generated with Claude Code