The first run died on `exec: node: not found` — rust:1.95-bookworm has no Node,
and the report needs cargo to resolve the workspace graph alongside Node to read
the registries. .gitea/scripts/ci.Dockerfile layers the two official images
together, so the parsing exists once rather than once per language.
Reports drifted crates, the Rust pin and the Docker base images in a single
issue titled "Dependency updates", rewritten in place rather than commented on
and closed automatically when nothing is out of date.
Nothing is upgraded automatically: this reports, a human decides. The report
separates what `cargo update` covers from what crosses a breaking boundary —
including the pre-1.0 rule, where `0.5 -> 0.6` is as breaking as `1.5 -> 2.0`.
The scanner is a standalone script under .gitea/scripts so the same file serves
the sibling Rust repos; the workflow reads the Rust version from this repo's own
Dockerfile rather than hard-coding one, so the check runs on the compiler the
image actually ships with.
Cargo is deliberately run online here: this project resolves a crate from a
private registry, and `--offline` would turn that into no report at all.
Requires a REGISTRY_TOKEN secret.
DSH Agent