Use recent lock file when checking API files
What the developer wrote
Authored by Tobin C. Harding
Use recent lock file when checking API files
Recently we added `--locked` to all the `cargo` invocations in the
script to check API text files. But if one has an updated lock file
(newer than recent) then this achieves nothing. I.e., if one has run
`cargo` _without_ `--locked` then the local lock file will have deps
that are too new (*cough* serde I'm looking at you).
Copy the recent lock file into place when the script is run locally
but preserve the lock file state once the script is finished running.
What changed, and why it matters
This is a small change to a developer helper script that checks whether the project's public API has changed. It makes the script temporarily use a known-good dependency lock file when run locally, then restores the developer's original lock file afterward. There is no security issue here.
No security action needed. Treat as a normal developer-experience/build-script improvement.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The commit modifies contrib/check-for-api-changes.sh. It saves any existing Cargo.lock, copies Cargo-recent.lock into place, runs the API generation/check, and restores the original Cargo.lock. This ensures the script’s –locked cargo invocations actually use the intended dependency versions when run outside CI. It is a build/tooling reliability fix, not a code change.
Changed components
contrib/check-for-api-changes.shInspect captured patch +9 / −0
diff --git a/contrib/check-for-api-changes.sh b/contrib/check-for-api-changes.sh
index b8d8c3f5..10fad61d 100755
--- a/contrib/check-for-api-changes.sh
+++ b/contrib/check-for-api-changes.sh
@@ -24,9 +24,18 @@ main() {
need_nightly
need_cargo_public_api
+ # If script is running in CI the recent lock file is copied into place
+ # already by the github action job. Locally be kind to the environment.
+ if [ "${GITHUB_ACTIONS:-}" != "true" ]; then
+ [ -f "Cargo.lock" ] && mv Cargo.lock Cargo.lock.tmp
+ cp Cargo-recent.lock Cargo.lock
+ fi
+
# Just check crates that are stabilising.
generate_api_files "units"
+ [ -f "Cargo.lock.tmp" ] && mv Cargo.lock.tmp Cargo.lock
+
check_for_changes
}
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.