asmuelle/cargo-impact

Blast-radius analysis for Rust PRs — SARIF code scanning + sticky PR comment

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Activelast commit Apr 23, 2026
License: Apache 2.0

Pinned Snippet

workflow.ymlSHA-pinned

uses: asmuelle/cargo-impact-action@c857cefe7ecc8be47527ea3615e82872e42b0ff2 # v1.0.0

tags can be moved; commit SHAs can't. why a SHA?

Inputs

name	description	required	default
version	cargo-impact version to install. `"latest"` pulls whatever `cargo install cargo-impact` resolves today; a specific version (e.g. `"0.3.0"`) is pinned for reproducibility.	no	latest
since	Git ref to diff against. Defaults to the PR base SHA on `pull_request` events, or `HEAD~1` otherwise. Override when you need a fixed reference (release branch comparisons, etc.).	no	""
fail-on	Severity gate: `"high"`, `"medium"`, `"low"`, or `""` for no gate. Empty by default — users can start informational-only and tighten once the signal is trusted.	no	""
confidence-min	Hide findings below this confidence (0.0-1.0). Default 0.0 (show all).	no	0.0
features	Comma-separated Cargo features to activate, as passed to `cargo impact --features`. Empty uses the manifest's default set.	no	""
all-features	Activate every feature in the manifest. Mutually exclusive with `no-default-features` per cargo-impact's flag contract.	no	false
no-default-features	Skip the manifest's default feature list.	no	false
semver-checks	Run `cargo-semver-checks` (slow, requires the tool to be installable on the runner). Off by default.	no	false
upload-sarif	Upload the SARIF file to GitHub code scanning. Requires the workflow to have `security-events: write` permission.	no	true
comment-on-pr	Post the markdown report as a sticky PR comment. Requires the workflow to have `pull-requests: write` permission and only runs on `pull_request` events.	no	true

Outputs

name	description
sarif-path	Path to the generated SARIF file (always produced).
comment-path	Path to the markdown PR-comment body (always produced).
exit-code	cargo-impact's exit code from the gate run. 0 = clean, 1 = `fail-on` tripped, 2 = tool error. Useful for conditional downstream steps.