·
Last changedVersion:
This version passed the hardening gate. Hardening updated the skill content, normalized allowed-tools to the canonical single-string form, and independently checked the resulting changes. Classified findings before hardening: 5. Classified findings closed: 0. Classified findings remaining: 5. Unclassified scanner findings remaining: 0. Review findings closed: 0. Review findings remaining: 13.
5
5
Expand | File | Group | Subtype | Severity | Status |
|---|---|---|---|---|---|
references/chapter_03.md | Supply Chain & Install-Time Trust | Install-time download and execute | Low | Open | |
references/chapter_01.md | Sensitive Data & Secret Exposure | Hardcoded secret | Low | Open | |
references/chapter_05.md | Supply Chain & Install-Time Trust | Install-time download and execute | Low | Open | |
references/chapter_03.md | Malicious Code & Command Execution | — | Low | Open | |
references/chapter_05.md | Malicious Code & Command Execution | — | Low | Open |
5 findings
Apply these guidelines when writing or reviewing Rust code. Based on Apollo GraphQL's Rust Best Practices Handbook.
Before reviewing, familiarize yourself with Apollo's Rust best practices. Read ALL relevant chapters in the same turn in parallel. Reference these files when providing feedback:
&T over .clone() unless ownership transfer is required&str over String, &[T] over Vec<T> in function parametersCopy types (≤24 bytes) can be passed by valueCow<'_, T> when ownership is ambiguousResult<T, E> for fallible operations; avoid panic! in productionunwrap()/expect() outside teststhiserror for library errors, anyhow for binaries only? operator over match chains for error propagation--release flagcargo clippy -- -D clippy::perf for performance hints.iter() instead of .into_iter() for Copy types.collect() callsRun regularly: cargo clippy --all-targets --all-features --locked -- -D warnings
Key lints to watch:
redundant_clone - unnecessary cloninglarge_enum_variant - oversized variants (consider boxing)needless_collect - premature collectionUse #[expect(clippy::lint)] over #[allow(...)] with justification comment.
process_should_return_error_when_input_empty()///) for public API examplescargo insta for snapshot testing generated outputdyn Trait only when heterogeneous collections are neededEncode valid states in the type system to catch invalid operations at compile time:
// comments explain why (safety, workarounds, design rationale)/// doc comments explain what and how for public APIsTODO needs a linked issue: // TODO(#42): ...#![deny(missing_docs)] for librariesGet started with chainctlchainctl skill install public/apollographql/rust-best-practices:latest
Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.
skills.cgr.dev/public/github.com/apollographql/skills/rust-best-practices:latest
MIT
HARDENING.md
LICENSE
SKILL.md
references/chapter_01.md
references/chapter_02.md
references/chapter_03.md
references/chapter_04.md
references/chapter_05.md
references/chapter_06.md
references/chapter_07.md
references/chapter_08.md
references/chapter_09.md