xtask/Cargo.toml
[package]
name = "xtask"
description = "gunnar's repository tasks: the dependency guard and the `cargo xtask ci` check run. Never a build dependency of anything."
version.workspace = true
edition.workspace = true
rust-version.workspace = true
license.workspace = true
repository.workspace = true
publish = false
[[bin]]
name = "xtask"
path = "src/main.rs"
[lib]
name = "xtask"
path = "src/lib.rs"
# ZERO dependencies, deliberately.
#
# Repository tooling is invoked as a tool, never as a dependency: docs generation and every other repository
# task lives here and is "invoked as a tool, never as a dependency". A workspace
# member does take part in resolver-2 feature unification for `cargo build
# --workspace`, so a dependency added here could in principle turn a feature on
# in a crate the appliance links. Nothing to unify is the strongest form of that
# guarantee, and the guard's whole job is not to be the thing it is guarding
# against.
[dependencies]
# The declaration, and the ONE writer that materializes a row's argv. MEASURED
# 2026-09-17 against the rule above: `cargo tree -p gunnar-server -e features`
# is byte-identical before and after this line, because the appliance ALREADY
# links nornir-build-thing 0.1.17 and gunnar-recipe adds only that and `anyhow`.
# Nothing new to unify, so the guarantee stands. (It said "1754 rows both ways";
# re-run on 2026-09-17 with cargo 1.98.1 the command prints 5029, so the row
# COUNT is corrected below where it is measured again. The byte-identity — which
# is the claim — still holds.)
gunnar-recipe = { path = "../crates/gunnar-recipe" }
# **The EXECUTION LEG of `cargo xtask build`** — `cargo_container::
# build_variant_in_container` over `DraupnirCargoRunner`, both of which live
# behind the `cargo-container` feature. The recipe cannot turn it on for us: it
# depends on this crate with the workspace defaults, and a feature is enabled by
# the manifest that wants it. ONE entry, and it is the WORKSPACE's
# (`nornir-build-thing = { version = "0.1.17", default-features = false }`) — a
# second version or a `path =` spelling here would resolve to a DIFFERENT
# package than `gunnar-recipe` re-exports, which is exactly how dwarves b81545c
# earned an `E0609`.
#
# MEASURED 2026-09-17 against the rule above, and re-measured rather than
# assumed, because this line turns a feature on in a crate the appliance links:
#
# cargo tree -p gunnar-server -e features 5029 rows before, 5029 after,
# `diff` EMPTY — byte-identical
# cargo tree --workspace -e features 5704 rows before, 5813 after
# (+109; `nornir-build-thing feature
# "cargo-container"` → draupnir 0.1.13
# → bollard 0.20.2 → hyper/tokio)
#
# The appliance's own graph is UNCHANGED, which is the guarantee that matters:
# every shipped artifact is built `-p <package> --target …`, a per-package
# resolve that never sees this member. What does change is the rows `--workspace`
# adds — `cargo clippy --workspace` and `cargo test --workspace` in `xtask ci`
# now also compile draupnir + bollard + tokio, because resolver-2 unifies
# features across the members of ONE invocation. That is a compile-time cost in
# two CI steps, not a byte in any delivered binary, and it is written down here
# rather than left to be discovered.
#
# (The note above records 1754 rows for the same `-p gunnar-server` command. That
# number does not reproduce on this tree — cargo 1.98.1 prints 5029 — so the
# figures here are from measurements taken today rather than carried forward.)
nornir-build-thing = { workspace = true, features = ["cargo-container", "provenance"] }
[dev-dependencies]
# The step-1 tests implement nornir-build-thing's ToolchainImageStore, whose
# methods return anyhow::Result.
anyhow = { workspace = true }
[lints.rust]
unsafe_code = "forbid"