unsafe-budget 0.4.2

keeps the unsafety demons out. an unsafe code budget gate for CI pipelines.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89

# getting started

## installation

```bash
# from source
cargo install --path .

# or build locally
cargo build --release
```

## first scan

run a scan on your rust project:

```bash
cd your-project
unsafe-budget scan
```

output:

```
unsafe-budget scan
==================
Analyzer: rustc_unsafe_lint
Language: rust

Totals:
  Workspace: 5 unsafe
  Dependencies: 42 unsafe
  Overall: 47 unsafe

Per-unit breakdown:
  UNIT                           KIND           UNSAFE
  ----------------------------------------------------
  libc                           dep            42
  my_crate                       workspace       5
```

## establish a baseline

once you're happy with the current state, create a baseline:

```bash
unsafe-budget update
```

this creates `unsafe-budget.lock` with the current counts.

## check in ci

add to your ci pipeline:

```bash
unsafe-budget check
```

exits with code 2 if any unit exceeds its baseline.

## scanning a go project

```bash
# install go-geiger
go install github.com/preeve9534/go-geiger@latest

# scan (auto-detected from go.mod)
cd your-go-project
unsafe-budget scan
```

## using sarif

unsafe-budget can both produce and consume SARIF 2.1.0 files:

```bash
# emit sarif from a scan
unsafe-budget scan --format sarif --details > results.sarif

# ingest sarif from another tool
unsafe-budget scan --analyzer sarif --manifest-path results.sarif
```

## next steps

- [usage guide](usage.md) - all cli options
- [architecture](architecture.md) - how it works
- [analyzers](analyzers.md) - available backends