[jolesonbethany1-dev]

Summary

Closes #85

Teams want the same flags every run (threshold, ignored paths, format) without retyping them. This PR adds depradar.toml — a per-project config file that supplies defaults for every repeatable CLI flag. CLI flags always win, so existing scripts and one-off commands are unaffected.

What was built

src/config.rs (new file) — typed config loader:

• ProjectConfig struct with four optional keys: fail_on, format, exclude, ecosystems
• FailOn enum (ordered None < Low < Medium < High < Critical, default High)
• ConfigEcosystem enum (npm/pypi/cargo/go/maven/rubygems/packagist, lowercase + canonical aliases)
• ConfigFormat enum (text/json)
• load_project_config(dir) — returns Ok(None) when absent, Err on parse failure; deny_unknown_fields rejects typos

src/bin/depradar.rs — config wired into the CLI:

• load_project_config(&cwd) called in main() before dispatch; invalid file → exit 2
• ResolvedConfig::resolve() merges: built-in defaults ← depradar.toml ← CLI flags
• --fail-on, --exclude, --ecosystem flags are now documented and fully active
• --format made Option<Format> so the config file can supply it

src/lib.rs — pub mod config added

File format

# depradar.toml

# Severity level at which the run exits with code 1.
# Accepted values: "low", "medium", "high", "critical", "none"
# Default: "high"
fail_on = "high"

# Output format for the scan command.
# Accepted values: "text", "json"
# Default: "text"
format = "text"

# Glob patterns for lockfile paths to skip.
# `*` matches non-separator chars; `**` matches everything including `/`.
# Default: [] (nothing excluded)
exclude = ["vendor/**", "third_party/**"]

# Restrict scanning to these ecosystems only.
# Accepted values: "npm", "pypi", "cargo", "go", "maven", "rubygems", "packagist"
# Default: [] (all ecosystems scanned)
ecosystems = ["npm", "pypi"]

All keys are optional. An empty depradar.toml is valid. Unknown keys are rejected with a parse error pointing to the file.

Tests

Unit tests in src/config.rs:

• FailOn ordering (None < Low < … < Critical)
• Round-trip FromStr/Display for FailOn, ConfigEcosystem, ConfigFormat
• Full-config TOML parses correctly
• Empty TOML gives default ProjectConfig
• Unknown key is rejected
• Invalid enum value is rejected
• load_project_config returns None when no file exists
• Loads correctly when given a directory path
• Returns Err on malformed TOML

Integration tests in tests/cli.rs (precedence tests per acceptance criteria):

• config_file_format_json_is_used_when_no_flag — file value used when no CLI flag
• cli_format_flag_overrides_config_file — CLI flag wins over file
• config_file_fail_on_none_exits_zero_even_with_findings — file value applied
• cli_fail_on_flag_overrides_config_file_none — CLI flag wins over file
• config_file_exclude_skips_matching_paths — file value applied
• cli_exclude_flag_overrides_config_file — CLI flag wins over file
• missing_config_file_uses_defaults — no file → built-in defaults
• invalid_config_file_exits_with_code_2 — bad file → exit 2 + error mentions depradar.toml

All 146 tests pass. cargo fmt --check, cargo clippy -- -D warnings, and cargo test -p deprader all green.

Docs

• README.md — new ### Project config file (depradar.toml) section with annotated example and key reference table; updated CLI options table reflecting newly active flags
• PROGRESS.md — entry added per the Definition of Done in CONTRIBUTING.md

Checklist

• Tests for precedence: file vs flag vs default
• cargo fmt, cargo clippy -- -D warnings and cargo test --workspace pass
• All commands and links in the new docs have been verified
• PROGRESS.md entry added
• Closes #85 in this description

[drips-wave]

@jolesonbethany1-dev Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits