sdf-jkl opened a new pull request, #11477:
URL: https://github.com/apache/arrow-rs/pull/11477

   # Which issue does this PR close?
   
   Related to #11166.
   
   # Rationale for this change
   
   This draft provides the Machete comparison for the proposed switch to Shear 
in #11476, focused on detection quality and false positives. It replaces the 
existing dependency-only Clippy runs with a repository-wide scan that also 
checks dev-dependencies and Parquet crates.
   
   Dependencies are intentionally unchanged and no ignores are added. The new 
job is expected to fail and expose the doctest false positives in CI for review.
   
   # What changes are included in this PR?
   
   - Add a job using cargo-machete 0.9.2 with `--with-metadata`, covering 
workspace packages and the excluded PyArrow crates.
   - Remove the 54 dependency-only Clippy invocations and preserve all 18 
regular Clippy checks.
   - Use the same SHA-pinned checkout and tool installer actions as the 
existing workflows.
   - Change only the two workflow files. Findings fail the job without applying 
fixes; merge requirements are unchanged.
   
   # Are these changes tested?
   
   `actionlint`, `git diff --check`, and `typos --config typos.toml` pass.
   
   On upstream base `e17d04788f`, the local Machete scan exits with status 1 
and reports:
   
   | Crate | Reported dependencies | Assessment |
   | --- | --- | --- |
   | `arrow-csv` | `bytes`, `futures`, `tokio` | False positives: used in 
reader doctests |
   | `arrow-json` | `bytes`, `futures`, `tokio` | False positives: used in 
reader doctests |
   
   Shear 1.14.0 passes all three scans on the same base with no findings. The 
previously observed unused and misplaced dependencies have already been 
corrected upstream. These are observed results on this checkout, not an 
exhaustive assessment of either tool's false-negative rate.
   
   The PR CI run will validate installation and execution in GitHub Actions.
   
   Codex assisted with the workflow edits, local validation, and this 
description.
   
   # Are there any user-facing changes?
   
   No. This changes CI only.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to