Rust: `cargo --config <file> clippy` is not clippy, `-Dclippy::pedantic` misses the regex, RUSTFLAGS -Dwarnings is warnings-as-errors (check SKIPs for Rust), RUSTDOCFLAGS credited, unsafe_code warn ≠ forbid, rust-toolchain.toml pins the version, release profile inheritance

The bugs sit in the Rust validator: the command match in ecosystems/rust/tools.py (around line 273), the regex patterns in ecosystems/rust/practices.py (lines 20-25), the unsafe_code logic in tools.py (lines 153-159), and cargo_build_types in ecosystems/rust/init.py. Start by reproducing one case, such as cargo --config x clippy or -Dclippy::pedantic, as a unit test. Done means each quoted repro gives the expected status and the existing Rust tests still pass. Several items are design questions, so confirm the approach with maintainers before changing behaviour.

nushell: every lint job runs cargo --config lints.toml clippy … → "clippy does not run" (tools.py:273 starts_with(argv, ("cargo","clippy"))); serde: -Dclippy::pedantic is missed by \bclippy::pedantic\b → "missing clippy::pedantic"; tokio and serde set RUSTFLAGS: -Dwarnings on every job while warnings-as-errors is "not applicable to Rust" (and ripgrep's FAIL hint says "run shellcheck"); ripgrep is credited -D warnings from RUSTDOCFLAGS only; ruff PASSes security-scanning "unsafe_code forbidden" while the workspace sets unsafe_code = "warn" and 13 files contain unsafe { (bat denys, which #[allow] overrides); nushell's rust-toolchain.toml pins 1.97.1 but every job is "Rust default"; ripgrep's release workflow builds a profile that inherits release ("missing Release").

Evidence from the corpus audit

nushell/nushell / static-analysis, compiler-warnings

• kind: FALSE_NEGATIVE
• actual: FAIL: Rust: clippy is configured (Cargo.toml, clippy.toml) but does not run; FAIL: Rust: missing Rust lint settings: cargo clippy, clippy::pedantic
• expected: PASS: every lint job (Linux/MacOS/Windows lint, and the fuzz jobs) runs clippy
• evidence: .github/workflows/ci.yml:178-187: - &step_clippy / name: Clippy / env: CARGO_BUILD_WARNINGS: deny / run: >- /
  rustup component add clippy / cargo --config "${{ github.workspace }}/.cargo/ci.toml" / clippy ${{ env.cargo-options }} / --profile ${{ env.profile }}
  (folded scalar: one command cargo --config <file> clippy --all-targets --profile dev);
  validator ecosystems/rust/tools.py:273: return analysed() if starts_with(argv, ("cargo", "clippy"), ("cargo-clippy",)) else None;
  ecosystems/rust/practices.py:20: r"\bcargo\s+(?:\+\S+\s+)?clippy\b" — both require clippy right after cargo (toolchain aside); verified re.search on the command → False
• repro: step run: cargo --config .cargo/ci.toml clippy --all-targets -- -D warnings → static-analysis "does not run"
• confidence: high

serde-rs/serde / compiler-warnings

• kind: FALSE_NEGATIVE
• actual: WARN: missing Rust lint settings: clippy::pedantic / found cargo clippy -D warnings
• expected: PASS: every clippy invocation denies clippy::pedantic
• evidence: .github/workflows/ci.yml:148: - run: cd serde && cargo clippy --features rc,unstable -- -Dclippy::all -Dclippy::pedantic (same on lines 149-153);
  validator ecosystems/rust/practices.py:25: _setting("clippy::pedantic", r"\bclippy::pedantic\b|^\s*pedantic\s*=") — \b does not match between D and c in -Dclippy::pedantic
  (checked: regex matches -D clippy::pedantic, not -Dclippy::pedantic)
• repro: step run: cargo clippy -- -Dclippy::pedantic → pedantic reported missing
• confidence: high

astral-sh/ruff / security-scanning (and sharkdp/bat wording)

• kind: FALSE_POSITIVE
• actual: ruff: PASS: Rust: CI scans the code for security problems with unsafe_code forbidden (unit .); bat: PASS ... with unsafe_code forbidden
• expected: ruff: WARN: the workspace sets unsafe_code = "warn", 13 files contain unsafe {, and only one of ~55 crates forbids it;
  bat: right status, but the crates deny (overridable by #[allow]), they do not forbid
• evidence: astral-sh__ruff/Cargo.toml:270-271: [workspace.lints.rust] / unsafe_code = "warn";
  grep -rl "forbid(unsafe_code)" crates --include=lib.rs --include=main.rs → only crates/ruff_text_size/src/lib.rs:19: #![forbid(unsafe_code)];
  grep -rl "unsafe {" crates --include=*.rs | wc -l → 13;
  sharkdp__bat/src/lib.rs:22: #![deny(unsafe_code)], src/bin/bat/main.rs:1: #![deny(unsafe_code)];
  validator ecosystems/rust/tools.py:153: _FORBIDS_UNSAFE = re.compile(r"#!\[\s*(?:forbid|deny)\s*\([^)]*\bunsafe_code\b"), :159: _FORBIDDEN = frozenset({"forbid", "deny"});
  docs/ecosystems/rust.md: unsafe_code forbidden crate-wide ... where cargo builds — one member crate's attribute is credited to the whole workspace build
• repro: workspace Cargo.toml with [workspace.lints.rust] unsafe_code = "warn", crates a (uses unsafe {}) and b (#![forbid(unsafe_code)]), CI cargo build --workspace → PASS
• confidence: high

tokio-rs/tokio, serde-rs/serde, BurntSushi/ripgrep, clap-rs/clap / warnings-as-errors

• kind: FALSE_NEGATIVE (design gap) + MESSAGE
• actual: tokio, serde: [SKIP] warnings-as-errors: not applicable to Rust; ripgrep: [FAIL] warnings-as-errors: warnings are not treated as errors in CI configuration / run shellcheck in CI: it fails on any finding; clap: FAIL for PowerShell/Shell only
• expected: PASS for tokio and serde (RUSTFLAGS: -Dwarnings on every job), and for a Rust project the hint should not be "run shellcheck"; Rust is the one ecosystem where "warnings as errors" has a canonical spelling
• evidence: tokio-rs__tokio/.github/workflows/ci.yml:14: RUSTFLAGS: -Dwarnings (also loom.yml:15, stress-test.yml:13);
  serde-rs__serde/.github/workflows/ci.yml:13: RUSTFLAGS: -Dwarnings;
  validator checks/warnings_as_errors.py: languages=handled(PracticeName.WARNINGS_AS_ERRORS); ecosystems/rust/practices.py defines only
  PracticeName.WARNINGS, HARDENING, SANITIZERS — -D warnings is folded into compiler-warnings, so Rust is never "handled" here
• repro: Cargo.toml + workflow with env: RUSTFLAGS: -Dwarnings and run: cargo build → SKIP
• confidence: medium (by design per docs, but the SKIP/FAIL wording is wrong for the ecosystem)

BurntSushi/ripgrep / compiler-warnings

• kind: FALSE_POSITIVE (one component) / MESSAGE
• actual: FAIL: Rust: missing Rust lint settings: cargo clippy, clippy::pedantic / Rust: found -D warnings
• expected: -D warnings should not be credited: the only occurrence is RUSTDOCFLAGS (rustdoc lints), nothing passes it to rustc or clippy
• evidence: grep -rn "D warnings|deny(warnings)|Dwarnings" over *.rs,*.toml,*.yml,*.sh → only .github/workflows/ci.yml, where :251-253:
  env: / RUSTDOCFLAGS: -D warnings / run: cargo doc --no-deps --document-private-items --workspace;
  validator ecosystems/rust/practices.py:22-23: -D warnings pattern is matched in any CI text
• repro: step with env: RUSTDOCFLAGS: -D warnings + run: cargo doc → "found -D warnings"
• confidence: medium

BurntSushi/ripgrep / ci-build-types

• kind: FALSE_NEGATIVE
• actual: FAIL: linux / nightly: missing Debug + sanitizers, Release, Release + sanitizers (all 6 combos "missing Release"); map: every release.yml build-release job has configurations: []
• expected: the release workflow builds a profile that inherits release; it should count as Release (even if only on tags)
• evidence: .github/workflows/release.yml:187: ${{ env.CARGO }} build --verbose --profile release-lto --features pcre2 ${{ env.TARGET_FLAGS }};
  Cargo.toml: [profile.release-lto] / inherits = "release"; validator ecosystems/rust/__init__.py:33-41 (cargo_build_types): return frozenset() if profiles else frozenset({"debug"}) — a custom profile yields no build type
• repro: Cargo.toml with [profile.fast] inherits = "release" + step cargo build --profile fast → no configuration
• confidence: low (tag-only workflow; custom profiles need Cargo.toml lookup)

nushell/nushell / platform-matrix (rust-toolchain.toml)

• kind: UNSUPPORTED
• actual: every nushell job: toolchains Rust default ([FAIL] platform-matrix ... Rust: ... (default, beta) style); ruff gets 1.99.0 only because a job sets RUSTUP_TOOLCHAIN
• expected: rust-toolchain.toml pins the toolchain every plain cargo invocation uses; the matrix should read 1.97.1 for nushell (and 1.99.0 for ruff from the file, not the env)
• evidence: nushell__nushell/rust-toolchain.toml:17: channel = "1.97.1"; astral-sh__ruff/rust-toolchain.toml:2: channel = "1.99.0"; astral-sh__ruff/.github/workflows/ci.yaml:401: RUSTUP_TOOLCHAIN: "1.99.0";
  validator: grep -rln rust-toolchain project_validator → only the rust-toolchain@ action pattern in ecosystems/rust/__init__.py
• repro: rust-toolchain.toml (channel = "1.80") + workflow run: cargo test → toolchain "default"
• confidence: medium

Found by the regression-corpus audit (235 real repositories, one or more per ecosystem profile; corpus and expected results in corpus/). Evidence is quoted from the audited checkouts at the commits pinned in corpus/projects.toml; <checkouts>/<owner>__<repo> is such a checkout.

🤖 Generated with Claude Code

https://claude.ai/code/session_01ByTXNqDWdM7HzezrFtEvQt