Guardrails / Collectors

Rust build

The Cargo build in the project directory: the crate it declares, the Rust version and edition it asks for, every workspace member, the dependencies each manifest names with where each comes from and whether it is pinned, and the lock file beside them.

Facts key	rust
Version	v1
Script	rust.py
Timeout	30 seconds

Inputs

Input	Description	Default	Environment
projectDir	Directory holding the project, relative to the directory the CLI runs in.	.	GUARDRAIL_INPUT_PROJECTDIR
maxMembers	Most workspace members to describe. A workspace past this carries the ones its globs resolve first.	200	GUARDRAIL_INPUT_MAXMEMBERS

A guardrail that declares an input of the same name passes it through, so the guardrail's configuration in buildnote.json is what decides these values.

A guardrail asks for these facts by name, and reads them back the same way:

{
  "collect": ["rust"]
}

rust = guardrail.facts("rust")

Facts

The document rust collects. A path carrying [] is an entry of the list before it, and one carrying [path] is a key of the object before it.

Fact	Meaning
directory	The projectDir input, as the guardrail configured it.
exists	Whether that directory is there. Nothing else is collected when it is not.
manifest	Path of the primary manifest, relative to projectDir, always Cargo.toml.
sources	Every manifest that was read and understood, in the order they were read. A manifest the reader could not handle is in unparsed instead.
declared	The Rust version the build asks for, or null when it asks for none. rust-toolchain.toml wins over rust-version, because it is what cargo installs rather than the floor the crate compiles at. A rust-version under [workspace.package] is read as the whole workspace's, which is what a member inheriting it with rust-version.workspace = true compiles at.
declared.version	Channel or version exactly as written, such as 1.76, stable or nightly-2026-03-01.
declared.source	File declaring it, relative to projectDir.
declared.pinned	Whether it names one exact version rather than a moving channel. stable, beta and nightly are not pinned; 1.76.0 is.
edition	The Rust edition the package declares, such as 2021, or null when it declares none and 2015 is implied. Taken from the root [package], then from [workspace.package] where the workspace declares one for its members to inherit, then from the first member declaring one of its own.
workspace	Whether the manifest declares a [workspace], so a guardrail can tell a single crate from the root of several.
projects	Every crate in the build: the root package when it is one, followed by every workspace member.
projects[].path	Directory of the crate, relative to projectDir, . for the project directory itself.
projects[].manifest	That crate's Cargo.toml, relative to projectDir.
projects[].name	Name the [package] table declares, or null when it declares none.
dependencies	What the manifests declare, split by whether the build asks for it itself.
dependencies.direct	Every dependency any manifest declares, in manifest order.
dependencies.direct[].name	Crate name as the manifest keys it. A renamed dependency is keyed by the name the code uses rather than the one it is published under.
dependencies.direct[].version	Requirement exactly as written, such as 1.0.197 or =1.0.197, or null when the dependency comes from a path, a git URL or the workspace.
dependencies.direct[].scopes	Which of dependencies, dev-dependencies, build-dependencies and workspace declare it.
dependencies.direct[].source	Manifest declaring it, relative to projectDir.
dependencies.direct[].pinned	Whether the requirement names one exact version. A bare 1.0 is Cargo's caret requirement and matches any compatible release, so only an = requirement is pinned.
dependencies.direct[].origin	Where it comes from: registry, path for a crate in this checkout, git for one fetched from a URL, or workspace when the member inherits the root's.
dependencies.transitive	Always empty. What Cargo.lock resolves is not read: lockfiles says whether one is committed.
lockfiles	Every lock file committed, relative to projectDir. A library that commits one pins its own build without constraining anything that depends on it.
dropped	Workspace members left out because maxMembers was reached. Above zero means projects and dependencies describe part of the build rather than all of it.
unparsed	Every manifest the reader could not handle, so a guardrail can tell a build that declares nothing from one nobody could read.
unparsed[].path	Path of that manifest, relative to projectDir.
unparsed[].reason	What stopped the reader.

A collector that cannot finish prints what it had along with an incomplete key saying why, so the facts below the point it stopped are absent. A check that cares reads incomplete before the rest.

Example facts

The example facts collected by rust collector:

{
  "directory": ".",
  "exists": true,
  "manifest": "Cargo.toml",
  "sources": [
    "Cargo.toml"
  ],
  "declared": {
    "version": "1.76",
    "source": "Cargo.toml",
    "pinned": true
  },
  "edition": "2021",
  "workspace": false,
  "projects": [
    {
      "path": ".",
      "manifest": "Cargo.toml",
      "name": "widget"
    }
  ],
  "dependencies": {
    "direct": [
      {
        "name": "serde",
        "version": "1.0.197",
        "scopes": [
          "dependencies"
        ],
        "source": "Cargo.toml",
        "pinned": false,
        "origin": "registry"
      },
      {
        "name": "anyhow",
        "version": "1.0.81",
        "scopes": [
          "dependencies"
        ],
        "source": "Cargo.toml",
        "pinned": false,
        "origin": "registry"
      },
      {
        "name": "clap",
        "version": "=4.5.4",
        "scopes": [
          "dependencies"
        ],
        "source": "Cargo.toml",
        "pinned": true,
        "origin": "registry"
      },
      {
        "name": "queue",
        "version": null,
        "scopes": [
          "dependencies"
        ],
        "source": "Cargo.toml",
        "pinned": false,
        "origin": "path"
      },
      {
        "name": "proptest",
        "version": "1.4.0",
        "scopes": [
          "dev-dependencies"
        ],
        "source": "Cargo.toml",
        "pinned": false,
        "origin": "registry"
      },
      {
        "name": "cc",
        "version": "1.0.94",
        "scopes": [
          "build-dependencies"
        ],
        "source": "Cargo.toml",
        "pinned": false,
        "origin": "registry"
      }
    ],
    "transitive": []
  },
  "lockfiles": [
    "Cargo.lock"
  ],
  "dropped": 0,
  "unparsed": []
}

Collected for

Guardrail	Category	Inputs
rust/edition-floor	rust	projectDir
rust/lockfile-committed	rust	projectDir
rust/no-git-dependencies	rust	projectDir
rust/version-declared	rust	projectDir

All collectors