Dependency and Toolchain Governance
Relevant source files
The following files were used as context for generating this wiki page:
Introduction
Dependency and Toolchain Governance in the guiltty project encompasses the strict management of the Rust development environment, external crate dependencies, and CI/CD security practices. The project prioritizes reproducibility and security by pinning toolchain versions and GitHub Action references to specific commit SHAs.
The governance model ensures that all workspace crates inherit a consistent Minimum Supported Rust Version (MSRV) and adhere to a unified set of linting and formatting rules. This approach mitigates the risk of supply chain attacks and environmental drift across different developer machines and CI runners.
Toolchain Management
The project utilizes mise to pin the development toolchain, ensuring all contributors use the same version of Rust and associated components.
Version Pinning
The Rust toolchain is explicitly set to version 1.96.0 in the mise.toml configuration. This version includes critical components for code quality and coverage analysis.
[tools]
rust = { version = "1.96.0", components = "clippy,rustfmt" }
"cargo:cargo-llvm-cov" = "0.8.7"
Sources: mise.toml:1-4, tasks/issue-16-consumability-assessment-from-iklo-guiltty-s.md:46-48
Minimum Supported Rust Version (MSRV)
The MSRV is declared at the workspace level and inherited by all crates within the repository to maintain compatibility and consistency.
| Configuration Level | Key | Value |
|---|---|---|
Workspace (Cargo.toml) | rust-version | 1.96.0 |
| Individual Crates | rust-version.workspace | true |
Sources: Cargo.toml:11, crates/guiltty-core/Cargo.toml:6, tasks/issue-16-consumability-assessment-from-iklo-guiltty-s.md:46-50
Dependency Governance
The project follows a "lock-down" strategy for external dependencies, requiring explicit approval before adding new crates to the workspace.
External Crates
Dependencies are categorized by their role in the system. For instance, guiltty-core handles image processing, while guiltty-kitty manages protocol encoding.
| Crate | Dependency | Features/Version | Purpose |
|---|---|---|---|
guiltty-core | image | 0.25.10 (png, jpeg, gif, bmp) | Image decoding and pixel conversion |
guiltty-kitty | base64 | 0.23.0 | Encoding RGBA data for terminal transmission |
Sources: crates/guiltty-core/Cargo.toml:14, crates/guiltty-kitty/Cargo.toml:13, tasks/plan.md:73-77
Dependency Addition Process
New external dependencies are treated as "ask-first" items. Developers must seek maintainer approval before introducing new crates to ensure they align with the project's boundaries and tech stack.
Sources: tasks/plan.md:73-77, tasks/plan.md:121-125
CI and Security Governance
Security in the CI pipeline is enforced through SHA-pinning of GitHub Actions and automated dependency monitoring.
GitHub Actions Hardening
To prevent supply chain vulnerabilities, all GitHub Actions in .github/workflows/ci.yml are pinned to reviewed commit SHAs rather than mutable tags.
The diagram illustrates how critical CI steps are anchored to specific immutable SHAs for security.
Sources: tasks/issue-8-chore-ci-hardening-follow-ups-caching-sha-pinned.md:12-16
Automated Updates
The project configures Dependabot to monitor and suggest updates for GitHub Actions, ensuring that the pinned SHAs do not become critically stale while remaining under developer control.
Sources: tasks/issue-8-chore-ci-hardening-follow-ups-caching-sha-pinned.md:48-52
Code Quality and Standards
Governance extends to the enforcement of static analysis and formatting rules across the entire workspace.
Quality Gate Requirements
CI enforces a strict quality gate that every task must pass before merging:
- Formatting:
cargo fmt --all -- --checkusing project-specificrustfmt.toml. - Linting:
cargo clippy --workspace --all-targets -- -D warningswith custom complexity thresholds. - Testing/Coverage:
cargo llvm-covwith a mandatory floor of 90% line coverage.
Sources: tasks/issue-16-consumability-assessment-from-iklo-guiltty-s.md:7-10, tasks/issue-8-chore-ci-hardening-follow-ups-caching-sha-pinned.md:7-10, rustfmt.toml:1-5
Workspace Lints
The Cargo.toml workspace configuration defines warnings for code complexity to maintain maintainability.
| Lint | Level | Description |
|---|---|---|
too_many_lines | warn | Threshold: 100 lines |
excessive_nesting | warn | Threshold: 6 levels |
Sources: Cargo.toml:16-20, clippy.toml:1-5
Summary
Dependency and Toolchain Governance in guiltty provides a robust framework for reproducible builds and secure CI operations. By pinning the Rust toolchain via mise, declaring a workspace-wide MSRV, and SHA-pinning CI actions, the project ensures high stability and protection against environmental or supply-chain inconsistencies. This governance model is further reinforced by a mandatory 90% test coverage floor and strict complexity lints.