acfoltzer / cargo-fund Goto Github PK

It would be nice to track which sponsor links you're already supporting, or any packages/repos you'd like to exclude from the output (like yourself under a different github org).

The simplest approach is probably to keep a config file around with a list of URIs, but we could also query the Github API, at least to get Github Sponsors information automatically.

The issue

Other applications make use of the GITHUB_API_TOKEN variable. This makes it hard to have application specific with minimum required privileges for each app.

Proposed solution

Name space the environment variable that cargo fund used by prefixing it with CARGO_FUND_ or something similar. So the environment variable will be called: CARGO_FUND_GITHUB_API_TOKEN.

Prior Art

See brew's environment variables. Specifically HOMEBREW_GITHUB_API_TOKEN

When I ran:

jeff@MacBook-Pro wasm % cargo fund
Error: Github API token must be provided through the CARGO_FUND_GITHUB_API_TOKEN environment variable or the --github-api-token flag.
jeff@MacBook-Pro wasm % cargo fund --github-api-token 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
Error: Insufficient Github API token scopes. Modify your token to include the `public_repo` and `user` scopes at https://github.com/settings/tokens.
jeff@MacBook-Pro wasm % cargo fund --github-api-token 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
Error: invalid format
jeff@MacBook-Pro wasm % cargo fund --github-api-token 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
Error: invalid format
jeff@MacBook-Pro wasm % 

I've deleted both tokens so it's safe to post them here.

Awesome small tool and initiative!

When I ran it on our fairly large project with 510 dependencies the default 5 second timeout kept being triggered though, seems to take around 12 seconds for our query.

There are projects with even more dependencies so how about increasing the default timeout to 30 sec?

This would be friendlier to users than asking them to create a personal access token. Unfortunately requires a web service and some careful thinking about security.

Hello, this is a great idea, thanks for building it. I have created an AUR package for cargo-fund, which is built from tagged releases. I see that a 0.2.0 version has been released to crates.io but not tagged in git. Would it be possible to tag this version (and future versions) in git as well?