56 results available
Sign in
Skills directory

rust-best-practices

apollographql

·

Last changed
Hardened

This skill has been hardened by Chainguard

Last changed

This version passed the hardening gate. Hardening updated the skill content, normalized allowed-tools to the canonical single-string form, and independently checked the resulting changes. Classified findings before hardening: 5. Classified findings closed: 0. Classified findings remaining: 5. Unclassified scanner findings remaining: 0. Review findings closed: 0. Review findings remaining: 13.


Open before hardening

5

Low
Open after hardening

5

Low

Expand
File
Group
Subtype
Severity
Status
references/chapter_03.md

Supply Chain & Install-Time Trust

Install-time download and execute

Low
Open
references/chapter_01.md

Sensitive Data & Secret Exposure

Hardcoded secret

Low
Open
references/chapter_05.md

Supply Chain & Install-Time Trust

Install-time download and execute

Low
Open
references/chapter_03.md

Malicious Code & Command Execution

—

Low
Open
references/chapter_05.md

Malicious Code & Command Execution

—

Low
Open

5 findings


SKILL.md

Rust Best Practices

Apply these guidelines when writing or reviewing Rust code. Based on Apollo GraphQL's Rust Best Practices Handbook.

Best Practices Reference

Before reviewing, familiarize yourself with Apollo's Rust best practices. Read ALL relevant chapters in the same turn in parallel. Reference these files when providing feedback:

Quick Reference

Borrowing & Ownership

  • Prefer &T over .clone() unless ownership transfer is required
  • Use &str over String, &[T] over Vec<T> in function parameters
  • Small Copy types (≤24 bytes) can be passed by value
  • Use Cow<'_, T> when ownership is ambiguous

Error Handling

  • Return Result<T, E> for fallible operations; avoid panic! in production
  • Never use unwrap()/expect() outside tests
  • Use thiserror for library errors, anyhow for binaries only
  • Prefer ? operator over match chains for error propagation

Performance

  • Always benchmark with --release flag
  • Run cargo clippy -- -D clippy::perf for performance hints
  • Avoid cloning in loops; use .iter() instead of .into_iter() for Copy types
  • Prefer iterators over manual loops; avoid intermediate .collect() calls

Linting

Run regularly: cargo clippy --all-targets --all-features --locked -- -D warnings

Key lints to watch:

  • redundant_clone - unnecessary cloning
  • large_enum_variant - oversized variants (consider boxing)
  • needless_collect - premature collection

Use #[expect(clippy::lint)] over #[allow(...)] with justification comment.

Testing

  • Name tests descriptively: process_should_return_error_when_input_empty()
  • One assertion per test when possible
  • Use doc tests (///) for public API examples
  • Consider cargo insta for snapshot testing generated output

Generics & Dispatch

  • Prefer generics (static dispatch) for performance-critical code
  • Use dyn Trait only when heterogeneous collections are needed
  • Box at API boundaries, not internally

Type State Pattern

Encode valid states in the type system to catch invalid operations at compile time:

struct Connection<State> { /* ... */ _state: PhantomData<State> }
struct Disconnected;
struct Connected;

impl Connection<Connected> {
    fn send(&self, data: &[u8]) { /* only connected can send */ }
}

Documentation

  • // comments explain why (safety, workarounds, design rationale)
  • /// doc comments explain what and how for public APIs
  • Every TODO needs a linked issue: // TODO(#42): ...
  • Enable #![deny(missing_docs)] for libraries

Install

Install with chainctl
chainctl skill install public/apollographql/rust-best-practices:latest
Get started with chainctl
View source

Harden your own skills

Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.

Provenance

Upstream sourcehttps://github.com/apollographql/skills
Upstream commit322da824b2845f42e21b30465c5ea71f3196b849
OCI reference

skills.cgr.dev/public/github.com/apollographql/skills/rust-best-practices:latest

License

MIT

Files

HARDENING.md

LICENSE

SKILL.md

references/chapter_01.md

references/chapter_02.md

references/chapter_03.md

references/chapter_04.md

references/chapter_05.md

references/chapter_06.md

references/chapter_07.md

references/chapter_08.md

references/chapter_09.md


The trusted source for open source

Talk to an expert
PrivacyTerms

Product

Chainguard ContainersChainguard LibrariesChainguard VMsChainguard OS PackagesChainguard ActionsChainguard Agent SkillsIntegrationsPricing
© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.