microsoft / microsoft/component-detection
Investigate if cargo dependencies of type 'build' should be considered dev dependencies
Nobody has claimed this yet.
- Dominant language
- C#
- Stars
- 553
- Forks
- 135
- Avg merge
- 20h 58m
- Merged PRs (30d)
- 6
Description
Today the detector when is inspecting the `kind` property of the dependency is only flagging it as dev dependency if `kind=dev` (see [here](https://github.com/microsoft/component-detection/blob/255e01115700899c5d5ea2cc82d1c3a40e68d315/src/Microsoft.ComponentDetection.Detectors/rust/RustCliDetector.cs#L243)), but other value that `kind` can have is `build`. These are dependencies used by the build script and probably should not be considered as dependencies of the final artifact.
- https://stackoverflow.com/questions/72861807/what-are-build-dependencies
- https://doc.rust-lang.org/cargo/reference/build-scripts.html
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in src/Microsoft.ComponentDetection.Detectors/rust/RustCliDetector.cs around line 243, then read the linked Cargo build-script documentation to understand how `kind=build` dependencies differ from `kind=dev`. Done means establishing the expected classification for build dependencies and documenting or implementing that behavior in the Rust detector.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- devtools
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100