GitHub Action · private repos

Know what every dependency change brings in, before you merge it.

Tensorust Cargo Check comments on every pull request that touches Cargo.toml or Cargo.lock. Free on public repos. A private repo needs a key: $9 a month per repo, cancel anytime.

Security advisories for the exact locked versions (OSV, which includes RustSec), with the smallest upgrade that fixes each one.
Yanked versions in the lock file, and crates a breaking release behind.
Licenses, with copyleft and missing ones flagged before legal finds them.
The newest MSRV in the tree, so you know which Rust can still build it.
New dependencies the PR adds, direct and transitive.
One comment per PR, edited in place. Optional fail-on: advisories blocks the merge.

See it on a public repo first, free: the action on GitHub · how it works.

After you pay

Copy the key from the page Stripe sends you to (bookmark it: it is also where you cancel).
In the repo, open Settings → Secrets and variables → Actions, and add a secret named TENSORUST_CARGO_CHECK_KEY.
Add .github/workflows/cargo-check.yml:

name: Cargo Check
on:
  pull_request:
    paths: ['**/Cargo.toml', '**/Cargo.lock']
permissions:
  contents: read
  pull-requests: write
jobs:
  cargo-check:
    runs-on: ubuntu-latest
    steps:
      - uses: Mattbusel/tensorust-cargo-check@v1
        with:
          license-key: ${{ secrets.TENSORUST_CARGO_CHECK_KEY }}
          fail-on: advisories   # optional

Questions

What happens on a private repo without a key?

The check still passes. It posts one line saying how to turn the report on, and nothing else.

Does my code leave GitHub?

No. The action reads Cargo.toml and Cargo.lock through the GitHub API inside your own runner. Only crate names and versions go to crates.io and OSV, and the key plus the repo name go to us to check the key. We store nothing.

Can I move the key to another repo?

A key is tied to one repo. Renamed or moved it? Email support@tensorust.com with the old and new name and we re-issue it.

How do I cancel?

From your key page, one button. The key keeps working to the end of the month you paid for. No refunds for partial months.

What if a key check fails because your server is down?

The action runs anyway. Our outage never blocks your pull request.

Know what every dependency change brings in, before you merge it.

Get a key

After you pay

Questions