[martin-kolinek]

🤖 ## Summary

• add dotted nested paths to JSON placeholders, such as {json:target.name}
• add repeatable --json-filter Boolean expressions with typed scalar equality and presence checks
• add --json-work-dir and --json-work-dir-parent for record-derived invocation directories
• keep JSON input production and output redirection outside cargo-each
• document the generic JSON contract and add fixture-backed filtering, nested substitution, working-directory, conflict, ordering, and validation tests

Cargo artifact example

cargo each --json-lines-file target/test-artifacts.jsonl \
    --json-filter 'reason=compiler-artifact and profile.test=true and executable' \
    --json-work-dir-parent manifest_path -- \
    miri {json:executable}

Validation

• cargo test -p cargo-each --quiet
• cargo clippy -p cargo-each --all-targets -- -D warnings
• real Cargo-message fixture dry-run through generic JSON mode
• just anvil-pr-fast

[Copilot]

🟡 Changes recommended

The parser can schedule artifacts from an unfinished trailing build and accepts paths that are relative on the host, causing execution from the wrong working directory.

5 open issues

• Reject records after the first build-finished message · New
• Require host-native absolute paths for artifacts · New
• Run the Miri-compatible artifact command · New
• Test relative-path validation independently for each field · New
• Assert exact errors for malformed inputs and conflicting options · New

What changed in this PR

Adds Cargo artifact input as a fifth execution mode for cargo-each, reusing its existing command executor to run test artifacts from their owning package directories.

Changes:

• Adds --cargo-artifacts-file with message parsing, metadata validation, and rendered diagnostic forwarding.
• Adds artifact-specific placeholders and integrates concurrency, timeouts, and failure handling.
• Documents the new contract and adds fixture-backed parsing, validation, and execution-plan tests.

File	Description
crates/​cargo-each/​tests/​fixtures/​cargo-artifacts.jsonl	Supplies artifact and diagnostic test records.
crates/​cargo-each/​src/​substitute.rs	Validates and expands artifact placeholders.
crates/​cargo-each/​src/​run.rs	Routes artifact input through the existing executor.
crates/​cargo-each/​src/​plan.rs	Builds ordered invocations with package working directories.
crates/​cargo-each/​src/​main.rs	Registers the parser module and updates CLI documentation.
crates/​cargo-each/​src/​error.rs	Adds artifact input and validation errors.
crates/​cargo-each/​src/​cli.rs	Exposes the artifact-file option.
crates/​cargo-each/​src/​cargo_artifacts.rs	Parses Cargo messages and selects executable test artifacts.
crates/​cargo-each/​README.md	Updates user-facing artifact-mode documentation.
crates/​cargo-each/​docs/​design/​README.md	Defines the new mode’s contract and usage example.

_{Review effort: Balanced}

[Codecov Comments Bot (codecov-commenter)]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 99.5%. Comparing base (8181344) to head (1ab66cc).
⚠️ Report is 4 commits behind head on main.

Additional details and impacted files

@@          Coverage Diff           @@
##            main    #351    +/-   ##
======================================
  Coverage   99.5%   99.5%            
======================================
  Files        351     351            
  Lines      64330   64497   +167     
======================================
+ Hits       64030   64198   +168     
+ Misses       300     299     -1     

Flag	Coverage Δ
linux	99.4% <100.0%> (+<0.1%)	⬆️
linux-arm	99.4% <100.0%> (+<0.1%)	⬆️
scheduled	?
windows	99.5% <100.0%> (+<0.1%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

🟡 Changes recommended

The native-test example uses the wrong runner, and several new negative tests rely on partial error assertions that do not verify the intended diagnostic or rejected input.

9 open issues

• Require host-native absolute paths for artifacts
• Reject records after the first build-finished message
• Run native test executables directly instead of passing them to Miri · New
• Assert complete or structured errors in negative tests · New
• Pin exact working-directory and malformed-path errors · New
• Assert the missing-input error cause and required option · New
• Pin the offending token and reason in malformed-path tests · New
• Test relative-path validation independently for each field
• Run the Miri-compatible artifact command

1 resolved since last review

• Assert exact errors for malformed inputs and conflicting options

_{Review effort: Balanced}

[github-advanced-security]

cargo-gamma found more than 20 potential problems in the proposed changes. Check the Files changed tab for more details.

[Copilot]

🔵 Needs a closer look

Malformed quoted filters can silently select no records and report success, while a new filesystem-dependent test remains enabled under Miri isolation.

9 open issues

• Require host-native absolute paths for artifacts
• Reject records after the first build-finished message
• Pin the offending token and reason in malformed-path tests
• Assert the missing-input error cause and required option
• Pin exact working-directory and malformed-path errors
• Assert complete or structured errors in negative tests
• Run native test executables directly instead of passing them to Miri
• Test relative-path validation independently for each field
• Run the Miri-compatible artifact command

2 previously missed issues

In code that hasn't changed since last review

Reject unescaped interior quotes in JSON values

crates/​cargo-each/​src/​filter.rs:317

name="a""b" survives tokenization as one atom, and the reused decoder treats its unescaped interior quotes as literal text instead of rejecting the malformed value. This can silently select no records and report success. Validate that the value is one complete quoted string before decoding the supported escapes, and add regression coverage for interior quotes and valid escaped quotes.

Use an embedded JSON fixture to avoid filesystem access under Miri

crates/​cargo-each/​src/​run.rs:1381

This new test goes through json_lines::load to File::open (src/json_lines.rs:39), introducing runtime filesystem access into an otherwise in-process filtering/planning test. The crate's other file-backed JSON tests explicitly exclude that path under Miri isolation (for example, file_only_json_mode_returns_input_context_before_loading_cargo below), but this one remains enabled. Feed the checked-in fixture through include_str! and --json-lines so the same assertions remain available under Miri without filesystem access.

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Human assessment is needed because the filter parser silently accepts malformed quoted values, potentially turning a configuration error into a successful no-op.

No open issues 🎉

9 resolved since last review

• Require host-native absolute paths for artifacts
• Reject records after the first build-finished message
• Pin the offending token and reason in malformed-path tests
• Assert the missing-input error cause and required option
• Pin exact working-directory and malformed-path errors
• Assert complete or structured errors in negative tests
• Run native test executables directly instead of passing them to Miri
• Test relative-path validation independently for each field
• Run the Miri-compatible artifact command

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Human assessment is needed because malformed quoted filter values can silently exclude records and produce a successful no-work run instead of a usage error.

No open issues 🎉

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Human assessment is needed to judge the impact of an unpublished finding that a documented command can fail in a fresh workspace.

No open issues 🎉

_{Review effort: Balanced}