Building without lockfile fails

[Nemo157]

> cargo install cargo-geiger --git https://github.com/rust-secure-code/cargo-geiger --force
    Updating git repository `https://github.com/rust-secure-code/cargo-geiger`
  Installing cargo-geiger v0.10.2 (https://github.com/rust-secure-code/cargo-geiger#df452561)
    Updating crates.io index
...
   Compiling cargo-geiger v0.10.2 (/home/nemo157/.cargo/git/checkouts/cargo-geiger-2d6bf70f2d1911c6/df45256/cargo-geiger)
error[E0609]: no field `repr` on type `&Platform`
   --> cargo-geiger/src/graph.rs:157:59
    |
157 | ...                   (Platform::from_str(p.repr.as_str()))
    |                                             ^^^^

It looks like cargo-geiger is relying on internal details of cargo_metadata::Dependency::target that have changed in v0.12.2.

[anderejd]

@jmcconnell26 Can you take a look at this? 🙏😃

[jmcconnell26]

@anderejd, I've landed #178 which should fix the immediate issue.
On a slightly related note if cargo_metadata have released a new version of their library, that means the changes I made to their library here oli-obk/cargo_metadata#148 should also be available. This would allow us to clean up some of the workarounds I had to put in, I'll look at putting this in too.

[jmcconnell26]

Long term I wonder if it might be possible to implement some sort of Canary CI/CD pipeline which attempts builds without lockfiles, to detect stuff like this, and give us at least some visibility into issues like this?

[anderejd]

Long term I wonder if it might be possible to implement some sort of Canary CI/CD pipeline which attempts builds without lockfiles, to detect stuff like this, and give us at least some visibility into issues like this?

Sounds like a good idea. Should be fairly simple to add a second build to the CI scripts/configs.

[jmcconnell26]

Raised #183 to perform a build without the lockfile, which should let us catch this in future.

[pinkforest]

Closing this as this was resolved - for the sake of completeness I've been using this as well :)

Re-open if replicated.