From 0440f94ba0bb782abd5d1bf6aad40b2c84a797cd Mon Sep 17 00:00:00 2001 From: alex <53851759+alxxjohn@users.noreply.github.com> Date: Mon, 24 Aug 2026 17:36:50 -0400 Subject: [PATCH 1/2] fix: gate Rust dead-code Cargo execution --- .../quality_rust_toolchain_dead_code.go | 4 +++ .../quality_rust_toolchain_dead_code_test.go | 27 +++++++++++++++++++ 2 files changed, 31 insertions(+) diff --git a/internal/codeguard/checks/quality/quality_rust_toolchain_dead_code.go b/internal/codeguard/checks/quality/quality_rust_toolchain_dead_code.go index 3ee3d54..5492bc3 100644 --- a/internal/codeguard/checks/quality/quality_rust_toolchain_dead_code.go +++ b/internal/codeguard/checks/quality/quality_rust_toolchain_dead_code.go @@ -14,6 +14,7 @@ import ( "github.com/devr-tools/codeguard/internal/codeguard/checks/support" "github.com/devr-tools/codeguard/internal/codeguard/core" + "github.com/devr-tools/codeguard/internal/codeguard/trust" ) const ( @@ -75,6 +76,9 @@ func rustToolchainDeadCodeFindings(ctx context.Context, env support.Context, tar return nil } level := toolchainDeadCodeLevel(cfg) + if err := trust.GuardConfigCommand("quality_rules.dead_code", "cargo check"); err != nil { + return []core.Finding{rustToolchainDeadCodeDiagnostic(env, level, err.Error())} + } issues, err := rustToolchainDeadCodeIssues(ctx, env, target, cfg) findings := make([]core.Finding, 0, len(issues)+1) for _, issue := range issues { diff --git a/internal/codeguard/checks/quality/quality_rust_toolchain_dead_code_test.go b/internal/codeguard/checks/quality/quality_rust_toolchain_dead_code_test.go index 539121e..49962b4 100644 --- a/internal/codeguard/checks/quality/quality_rust_toolchain_dead_code_test.go +++ b/internal/codeguard/checks/quality/quality_rust_toolchain_dead_code_test.go @@ -8,8 +8,35 @@ import ( "github.com/devr-tools/codeguard/internal/codeguard/checks/support" "github.com/devr-tools/codeguard/internal/codeguard/core" + "github.com/devr-tools/codeguard/internal/codeguard/trust" ) +func TestRustToolchainDeadCodeRequiresConfigCommandTrust(t *testing.T) { + originalPolicy := trust.Current() + t.Cleanup(func() { trust.Set(originalPolicy) }) + trust.Set(trust.Policy{}) + + enabled := true + env := support.Context{ + Config: core.Config{Checks: core.CheckConfig{QualityRules: core.QualityRulesConfig{ + DeadCode: core.QualityDeadCodeConfig{Enabled: &enabled, Mode: "toolchain"}, + }}}, + NewFinding: func(input support.FindingInput) core.Finding { + return core.Finding{RuleID: input.RuleID, Level: input.Level, Message: input.Message} + }, + } + target := core.TargetConfig{Name: "crate", Path: t.TempDir(), Language: "rust"} + + findings := rustToolchainDeadCodeFindings(t.Context(), env, target) + + if len(findings) != 1 { + t.Fatalf("findings = %+v, want one trust diagnostic", findings) + } + if !strings.Contains(findings[0].Message, "refusing to run config-supplied command") { + t.Fatalf("message = %q, want config command trust error", findings[0].Message) + } +} + func TestParseCargoDeadCodeDiagnostics(t *testing.T) { output := `{"reason":"compiler-message","message":{"level":"error","message":"function ` + "`unused_helper`" + ` is never used","code":{"code":"dead_code"},"spans":[{"file_name":"src/lib.rs","line_start":3,"column_start":4,"is_primary":true}]}}` + "\n" + `{"reason":"compiler-message","message":{"level":"warning","message":"unreachable statement","code":{"code":"unreachable_code"},"spans":[{"file_name":"src/lib.rs","line_start":8,"column_start":5,"is_primary":true}]}}` + "\n" + From 427c6f60e51cfcaf160bd6e555af4773a8d4d07d Mon Sep 17 00:00:00 2001 From: Alex Wilkerson John Date: Mon, 24 Aug 2026 19:48:17 -0400 Subject: [PATCH 2/2] fix: support Go 1.23 in Rust dead-code test --- .../checks/quality/quality_rust_toolchain_dead_code_test.go | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/internal/codeguard/checks/quality/quality_rust_toolchain_dead_code_test.go b/internal/codeguard/checks/quality/quality_rust_toolchain_dead_code_test.go index 49962b4..738bd6e 100644 --- a/internal/codeguard/checks/quality/quality_rust_toolchain_dead_code_test.go +++ b/internal/codeguard/checks/quality/quality_rust_toolchain_dead_code_test.go @@ -1,6 +1,7 @@ package quality import ( + "context" "os" "path/filepath" "strings" @@ -27,7 +28,7 @@ func TestRustToolchainDeadCodeRequiresConfigCommandTrust(t *testing.T) { } target := core.TargetConfig{Name: "crate", Path: t.TempDir(), Language: "rust"} - findings := rustToolchainDeadCodeFindings(t.Context(), env, target) + findings := rustToolchainDeadCodeFindings(context.Background(), env, target) if len(findings) != 1 { t.Fatalf("findings = %+v, want one trust diagnostic", findings)