Skip to content

fix: stop ignoring the tracked Cargo.lock, unblinding the deps scanner (#108) #110

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
bdelanghe wants to merge 1 commit into from
+6 −4
Closed

fix: stop ignoring the tracked Cargo.lock, unblinding the deps scanner (#108) #110

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 0 additions & 1 deletion .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,6 @@

# Global build artifacts
target/
Cargo.lock

# Global temporary and log files
*.tmp
Expand Down
9 changes: 6 additions & 3 deletions crates/xtask/src/main.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10547,7 +10547,6 @@ fn generate_full_gitignore() -> Result<String> {
# Rust build artifacts
############################
/target/
Cargo.lock

############################
# IDE & editor
Expand Down Expand Up @@ -10676,9 +10675,13 @@ fn generate_canonical_gitignore() -> Result<String> {

// Define known ignorable patterns that should be included if they exist in the tree
let ignorable_patterns = vec![
// Rust build artifacts
// Rust build artifacts. Cargo.lock is deliberately absent: this is a
// workspace with a COMMITTED lockfile, and ignoring a tracked file is
// inert for git but not for tools that match .gitignore patterns
// directly — osv-scanner skipped it and reported green having scanned
// nothing for months (#108). The entry was a default carried over from
// the library case, where Cargo.lock genuinely is not committed.
("target", "/target/"),
("Cargo.lock", "Cargo.lock"),
// IDE & editor
(".vscode", ".vscode/"),
(".idea", ".idea/"),
Expand Down
Loading