unsafe-budget 0.4.2

keeps the unsafety demons out. an unsafe code budget gate for CI pipelines.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146

use crate::output::Format;
use clap::{Args, Parser, Subcommand};
use std::path::PathBuf;

#[derive(Parser)]
#[command(name = "unsafe-budget")]
#[command(about = "keeps the unsafety demons out. an unsafe code budget gate for CI pipelines.")]
#[command(version)]
pub struct Cli {
    #[command(subcommand)]
    pub command: Command,
}

#[derive(Subcommand)]
pub enum Command {
    /// run analyzers and print results
    Scan(ScanArgs),

    /// check against baseline/budget, exit non-zero on violation
    Check(ScanArgs),

    /// update baseline from current scan
    Update(ScanArgs),

    /// list available analyzers
    Plugins(PluginsArgs),
}

#[derive(Args, Clone)]
pub struct ScanArgs {
    /// output format
    #[arg(long, default_value = "text")]
    pub format: Format,

    /// analyzer to use (rustc_unsafe_lint, cargo_geiger, go_geiger, sarif, or auto)
    #[arg(long, default_value = "auto")]
    pub analyzer: String,

    /// only scan workspace crates (exclude dependencies)
    #[arg(long)]
    pub workspace_only: bool,

    /// include dependencies in scan (default: from config or true)
    #[arg(long, conflicts_with = "no_deps")]
    pub include_deps: bool,

    /// exclude dependencies from scan
    #[arg(long)]
    pub no_deps: bool,

    /// Cargo features to enable
    #[arg(long, value_delimiter = ',')]
    pub features: Vec<String>,

    /// enable all features
    #[arg(long)]
    pub all_features: bool,

    /// disable default features
    #[arg(long)]
    pub no_default_features: bool,

    /// build all targets
    #[arg(long)]
    pub all_targets: bool,

    /// target triple(s) to build
    #[arg(long, value_delimiter = ',')]
    pub targets: Vec<String>,

    /// path to Cargo.toml
    #[arg(long)]
    pub manifest_path: Option<PathBuf>,

    /// path to config file (default: unsafe-budget.toml)
    #[arg(long)]
    pub config: Option<PathBuf>,

    /// show detailed occurrences
    #[arg(long)]
    pub details: bool,

    /// timeout in seconds for plugin execution (overrides config)
    #[arg(long)]
    pub plugin_timeout: Option<u64>,
}

#[derive(Args)]
pub struct PluginsArgs {
    /// output format
    #[arg(long, default_value = "text")]
    pub format: Format,
}

/// parse CLI, handling both standalone and cargo plugin invocation.
/// - Standalone: `unsafe-budget scan`
/// - Cargo plugin: `cargo unsafe-budget scan` (cargo passes "unsafe-budget" as first arg)
pub fn parse() -> Cli {
    let mut args: Vec<String> = std::env::args().collect();

    // if invoked as cargo plugin, first arg after binary is "unsafe-budget" - skip it
    if args.len() > 1 && args[1] == "unsafe-budget" {
        args.remove(1);
    }

    Cli::parse_from(args)
}

#[cfg(test)]
mod tests {
    use super::*;
    use clap::error::ErrorKind;

    #[test]
    fn include_deps_and_no_deps_conflict() {
        let result = Cli::try_parse_from(["unsafe-budget", "scan", "--include-deps", "--no-deps"]);
        match result {
            Err(e) => assert_eq!(e.kind(), ErrorKind::ArgumentConflict),
            Ok(_) => panic!("expected ArgumentConflict error"),
        }
    }

    #[test]
    fn include_deps_alone_is_accepted() {
        let cli = Cli::try_parse_from(["unsafe-budget", "scan", "--include-deps"]).unwrap();
        match cli.command {
            Command::Scan(args) => {
                assert!(args.include_deps);
                assert!(!args.no_deps);
            }
            _ => panic!("expected scan command"),
        }
    }

    #[test]
    fn no_deps_alone_is_accepted() {
        let cli = Cli::try_parse_from(["unsafe-budget", "scan", "--no-deps"]).unwrap();
        match cli.command {
            Command::Scan(args) => {
                assert!(!args.include_deps);
                assert!(args.no_deps);
            }
            _ => panic!("expected scan command"),
        }
    }
}