add conditional generation of temp file for powershell

[krVatsal]

Based on the discussion in discord https://discord.com/channels/731730685944922173/731738914812854303/1479960786871779459

On Windows, if cargo-about fails (often due to PowerShell detection in process ancestry), fall back to using a temporary file to work around the issue.

[gemini-code-assist]

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request improves the reliability of the cargo-about license generation process within Windows environments. It introduces a robust fallback strategy to circumvent issues where cargo-about might fail when attempting to capture its output directly. By conditionally utilizing a temporary file for output, the change ensures that license information can be successfully generated even when direct stdout capture encounters problems, often related to PowerShell interactions.

Highlights

• Windows Fallback: Implemented a conditional fallback mechanism for cargo about generate specifically on Windows operating systems.
• Temporary File Usage: If the initial attempt to capture cargo about generate output via stdout fails on Windows, the process now retries by writing the output to a temporary JSON file, which is then read and subsequently deleted.

Changelog

• tools/third-party-licenses/src/cargo.rs
  • Added Windows-specific logic to retry cargo about generate using a temporary output file if the initial command fails.
  • Implemented reading the generated JSON content from the temporary file and ensuring its cleanup.
  • Updated error handling to provide more detailed messages, distinguishing between initial command failures and temporary file fallback failures.

Activity

• No human activity has been recorded on this pull request yet.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[cubic-dev-ai]

1 issue found across 1 file

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="tools/third-party-licenses/src/cargo.rs">

<violation number="1" location="tools/third-party-licenses/src/cargo.rs:118">
P2: Temp file is not cleaned up on error paths. If `read_to_string` fails or if the second `cargo about` invocation produces a partial output file before failing, `.cargo-about-temp.json` is left in the workspace root. Move cleanup to cover all exit paths, for example by removing the file before returning errors.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[gemini-code-assist]

Code Review

This pull request adds a fallback mechanism for "cargo about" on Windows to workaround a PowerShell detection issue. However, the current implementation uses a fixed filename in the workspace directory for a temporary file, which introduces security risks such as race conditions and symlink attacks. To mitigate these vulnerabilities and improve overall robustness, it is recommended to use a unique filename in the system's temporary directory, ideally leveraging the "tempfile" crate for safer temporary file management, and to enhance error reporting by capturing "stderr" on retry attempts.