build: add external types checks

actix-client-ip-cloudflare/Cargo.toml

@@ -14,6 +14,15 @@ rust-version.workspace = true
 rustdoc-args = ["--cfg", "docsrs"]
 all-features = true
 
+[package.metadata.cargo_check_external_types]
+allowed_external_types = [
+    "actix_http::*",
+    "actix_utils::*",
+    "actix_web::*",
+    "http::*",
+    "ipnetwork::*",
+]
+
 [features]
 default = ["fetch-ips"]
 fetch-ips = ["fetch-ips-rustls"]

actix-hash/Cargo.toml

@@ -14,6 +14,23 @@ rust-version.workspace = true
 all-features = true
 rustdoc-args = ["--cfg", "docsrs"]
 
+[package.metadata.cargo_check_external_types]
+allowed_external_types = [
+    "actix_http::*",
+    "actix_utils::*",
+    "actix_web::*",
+    "blake2::*",
+    "blake3::*",
+    "crypto_common::*",
+    "digest::*",
+    "generic_array::*",
+    "md4::*",
+    "md5::*",
+    "sha1::*",
+    "sha2::*",
+    "sha3::*",
+]
+
 [features]
 default = ["blake2", "blake3", "md4", "md5", "sha1", "sha2", "sha3"]
 blake2 = ["dep:blake2"]

actix-web-lab/Cargo.toml

@@ -19,6 +19,24 @@ rust-version.workspace = true
 all-features = true
 rustdoc-args = ["--cfg", "docsrs"]
 
+[package.metadata.cargo_check_external_types]
+allowed_external_types = [
+    "actix_http::*",
+    "actix_service::*",
+    "actix_utils::*",
+    "actix_web_lab_derive::*",
+    "actix_web::*",
+    "arc_swap::*",
+    "bytes::*",
+    "bytestring::*",
+    "futures_core::*",
+    "http::*",
+    "mime::*",
+    "serde_json::*",
+    "serde::*",
+    "tokio::*",
+]
+
 [features]
 default = ["derive"]
 derive = ["actix-web-lab-derive"]

justfile

@@ -66,3 +66,29 @@ doc *args:
 doc-watch:
     RUSTDOCFLAGS="--cfg=docsrs" cargo +nightly doc --no-deps --workspace --all-features --open
     cargo watch -- RUSTDOCFLAGS="--cfg=docsrs" cargo +nightly doc --no-deps --workspace --all-features
+
+# Check for unintentional external type exposure on all crates in workspace.
+check-external-types-all toolchain="+nightly-2024-05-01":
+    #!/usr/bin/env bash
+    set -euo pipefail
+    exit=0
+    for f in $(find . -mindepth 2 -maxdepth 2 -name Cargo.toml | grep -vE "\-codegen/|\-derive/|\-macros/"); do
+        if ! just check-external-types-manifest "$f" {{ toolchain }}; then exit=1; fi
+        echo
+        echo
+    done
+    exit $exit
+
+# Check for unintentional external type exposure on all crates in workspace.
+check-external-types-all-table toolchain="+nightly-2024-05-01":
+    #!/usr/bin/env bash
+    set -euo pipefail
+    for f in $(find . -mindepth 2 -maxdepth 2 -name Cargo.toml | grep -vE "\-codegen/|\-derive/|\-macros/"); do
+        echo
+        echo "Checking for $f"
+        just check-external-types-manifest "$f" {{ toolchain }} --output-format=markdown-table
+    done
+
+# Check for unintentional external type exposure on a crate.
+check-external-types-manifest manifest_path toolchain="+nightly-2024-05-01" *extra_args="":
+    cargo {{ toolchain }} check-external-types --manifest-path "{{ manifest_path }}" {{ extra_args }}