# Ported from alibaba/open-code-review (Apache-2.0):
#   internal/config/rules/rule_docs/cargo_toml.md
#   at commit 89ec55b14442c9f2601fb55b5f554fb6fabbe2c7.
# OCR tool names were replaced with this workflow's read-only
# exploration language. See the NOTICE.md and LICENSE files
# in rules/builtin/ for attribution and license details.
version: 1

rules:
  - id: format.cargo-toml
    match:
      paths:
        - "**/Cargo.toml"
    checks:
      - id: cargo-manifest-hygiene
        category: correctness
        guidance: |
          - Avoid introducing wildcard dependency versions such as `*`; use an explicit compatible version requirement
          - Avoid unpinned `git` dependencies in production crates unless a `rev`, `tag`, or documented policy makes the source reproducible
          - Keep dependencies in the narrowest appropriate section: `dependencies`, `dev-dependencies`, `build-dependencies`, or target-specific dependencies
          - Prefer workspace-managed versions and features in multi-crate repositories when the surrounding manifest already uses workspace inheritance
      - id: edition-msrv-and-resolver
        category: correctness
        guidance: |
          - New packages should declare an explicit `edition`
          - Library crates should declare `rust-version` when the repository has a minimum supported Rust version policy
          - Workspaces using feature resolver v2 or newer should avoid accidentally falling back to legacy feature unification
      - id: feature-flags
        category: correctness
        guidance: |
          - Features should be additive and should not disable behavior in dependent crates
          - Optional dependencies should be exposed through intentional feature names rather than leaking internal dependency names when that would become public API
          - Default features should stay small for libraries; avoid enabling heavy optional integrations by default without a clear reason
      - id: release-and-metadata
        category: correctness
        guidance: |
          - Published crates should include accurate `license` or `license-file`, `repository`, `description`, and relevant include/exclude settings
          - Avoid accidentally packaging generated artifacts, credentials, local paths, test fixtures with secrets, or large binary assets
