crabwatch

Crabwatch audits GitHub Actions workflows across Rust project repositories.

It provides:

• the .github/workflows/crabwatch.yml workflow used by the rust-lang organization.
• the crabwatch CLI for scanning GitHub repositories or organizations.

Note

This project is intended to be used only by the Rust project.

Checks

Crabwatch runs zizmor with the zizmor-default.yml configuration file, maintained by the Rust Infrastructure team.

Design principles

• Repositories should never experience CI failures due to new versions of crabwatch or zizmor. Before introducing new mandatory lints, the Infrastructure team will raise PRs to fix them.
• Checks are managed centrally here, so other repositories only need their own zizmor setup if they want stricter checks.

How the GitHub Action works

A ruleset in the rust-lang GitHub organization is configured to run the file .github/workflows/crabwatch.yml.

The workflow runs for pull requests and merge queue checks in repositories that set crabwatch = true in the [custom-properties] section of their team repository definition.

The workflow does not run the Crabwatch CLI. The CLI is a separate tool for manually auditing repositories with the same configuration.

CLI usage

Analyze every eligible repository in a GitHub organization:

GITHUB_TOKEN=$(gh auth token) cargo run -- analyze --org rust-lang

Set CRABWATCH_LOG=debug to debug issues.

Cache

By default, the CLI stores its data under the platform's user cache directory in a crabwatch subdirectory, so that you don't have to clone repositories twice if you already have the latest commit.

Docs

• GitHub: required workflows configured through org-wide rulesets
• zizmor documentation