fix: force NO_COLOR on cargo subprocesses so the parser stops missing colorized version: lines (#22)

* fix: force NO_COLOR on cargo subprocesses so the parser stops missing colorized `version:` lines

When a workflow sets `CARGO_TERM_COLOR=always` (or the user's env enables
it), cargo wraps field labels in ANSI SGR escapes:

    \e[1m\e[92mversion:\e[0m 0.6.0

The cargo info parser at lib.js:155 was anchored — `^version:` — so the
escape-prefixed line didn't match, `parseCargoInfoVersion` returned null,
`getPublishedVersion` rejected, and `filterPublishable` warned and skipped
the candidate. Net effect: `roas` (and any other crate run under a
color-on workflow) silently dropped out of the publish output even though
it's published on crates.io.

Fix in two layers:

- Spawn `cargo metadata` and `cargo info` with `CARGO_TERM_COLOR=never`
  and `NO_COLOR=1` layered over `process.env` via a `plainEnv()` helper.
  Cargo never produces ANSI escapes for the output we parse, regardless
  of the calling workflow's preferences.
- Strip ANSI SGR escapes in `parseCargoInfoVersion` before the regex
  match — defense-in-depth so the parser stays correct even if a future
  caller bypasses `plainEnv()`.

Tests: new regression case feeds the parser the exact colorized
`version:` line cargo emits under `CARGO_TERM_COLOR=always`. 33/33 pass;
dist rebuilt.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Sergey Vilgelm <sergey@vilgelm.com>

* chore: bump to 1.1.1

Patch bump for the cargo-info color-env fix in this branch.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Sergey Vilgelm <sergey@vilgelm.com>

---------

Signed-off-by: Sergey Vilgelm <sergey@vilgelm.com>

Author: SVilgelm

dist/index.js

@@ -28024,7 +28024,7 @@ function runCargoMetadata(manifestPath) {
         "--format-version",
         "1",
       ],
-      { cwd },
+      { cwd, env: plainEnv() },
     );
 
     const stdoutChunks = [];
@@ -28062,6 +28062,15 @@ function runCargoMetadata(manifestPath) {
   });
 }
 
+// Force cargo to emit plain text regardless of the workflow's
+// CARGO_TERM_COLOR setting. We parse stdout ourselves; ANSI escapes wrap
+// the field labels (`\e[1m\e[92mversion:\e[0m 0.6.0`) and break anchored
+// regex matches. NO_COLOR is set too as a belt-and-suspenders for any
+// non-cargo subprocess that might inherit this.
+function plainEnv() {
+  return { ...process.env, CARGO_TERM_COLOR: "never", NO_COLOR: "1" };
+}
+
 // Cargo's `publish` field semantics:
 //   null         → unrestricted (publishable)
 //   []           → `publish = false` in Cargo.toml (NOT publishable)
@@ -28132,9 +28141,13 @@ function compareSemver(a, b) {
   return 0;
 }
 
-// Pulls the published version from cargo info's stdout.
+// Pulls the published version from cargo info's stdout. Strips ANSI SGR
+// escapes first — `getPublishedVersion` forces NO_COLOR on the spawn, but
+// the parser stays robust if anything else (e.g. a future caller) feeds it
+// colorized output.
 function parseCargoInfoVersion(stdout) {
-  const m = stdout.match(/^version:\s*(\S+)/im);
+  const plain = stdout.replace(/\x1b\[[0-9;]*m/g, "");
+  const m = plain.match(/^version:\s*(\S+)/im);
   return m ? m[1] : null;
 }
 
@@ -28156,7 +28169,7 @@ function parseCargoInfoVersion(stdout) {
 function getPublishedVersion(pkgName, cwd, registry) {
   return new Promise((resolve, reject) => {
     const args = ["info", pkgName, "--registry", registry || "crates-io"];
-    const cmd = (0,child_process__WEBPACK_IMPORTED_MODULE_1__.spawn)("cargo", args, { cwd });
+    const cmd = (0,child_process__WEBPACK_IMPORTED_MODULE_1__.spawn)("cargo", args, { cwd, env: plainEnv() });
 
     const stdoutChunks = [];
     const stderrChunks = [];

lib.js

@@ -42,7 +42,7 @@ export function runCargoMetadata(manifestPath) {
         "--format-version",
         "1",
       ],
-      { cwd },
+      { cwd, env: plainEnv() },
     );
 
     const stdoutChunks = [];
@@ -80,6 +80,15 @@ export function runCargoMetadata(manifestPath) {
   });
 }
 
+// Force cargo to emit plain text regardless of the workflow's
+// CARGO_TERM_COLOR setting. We parse stdout ourselves; ANSI escapes wrap
+// the field labels (`\e[1m\e[92mversion:\e[0m 0.6.0`) and break anchored
+// regex matches. NO_COLOR is set too as a belt-and-suspenders for any
+// non-cargo subprocess that might inherit this.
+function plainEnv() {
+  return { ...process.env, CARGO_TERM_COLOR: "never", NO_COLOR: "1" };
+}
+
 // Cargo's `publish` field semantics:
 //   null         → unrestricted (publishable)
 //   []           → `publish = false` in Cargo.toml (NOT publishable)
@@ -150,9 +159,13 @@ export function compareSemver(a, b) {
   return 0;
 }
 
-// Pulls the published version from cargo info's stdout.
+// Pulls the published version from cargo info's stdout. Strips ANSI SGR
+// escapes first — `getPublishedVersion` forces NO_COLOR on the spawn, but
+// the parser stays robust if anything else (e.g. a future caller) feeds it
+// colorized output.
 export function parseCargoInfoVersion(stdout) {
-  const m = stdout.match(/^version:\s*(\S+)/im);
+  const plain = stdout.replace(/\x1b\[[0-9;]*m/g, "");
+  const m = plain.match(/^version:\s*(\S+)/im);
   return m ? m[1] : null;
 }
 
@@ -174,7 +187,7 @@ export function parseCargoInfoVersion(stdout) {
 export function getPublishedVersion(pkgName, cwd, registry) {
   return new Promise((resolve, reject) => {
     const args = ["info", pkgName, "--registry", registry || "crates-io"];
-    const cmd = spawn("cargo", args, { cwd });
+    const cmd = spawn("cargo", args, { cwd, env: plainEnv() });
 
     const stdoutChunks = [];
     const stderrChunks = [];

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "rust-metadata-action",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "description": "GitHub action to retrieve metadata, including crates, features, and other relevant information of the Rust project",
   "keywords": [
     "GitHub",

package.json

@@ -271,6 +271,16 @@ test("parseCargoInfoVersion is case-insensitive on the key", () => {
   assert.equal(parseCargoInfoVersion("Version: 0.1.0\n"), "0.1.0");
 });
 
+test("parseCargoInfoVersion strips ANSI escapes from cargo's colorized output", () => {
+  // What `cargo info` emits when CARGO_TERM_COLOR=always is set in env —
+  // the field label is wrapped in SGR codes, so a naive `^version:` regex
+  // would miss it. Reproduces the CI warning seen against sv-tools/roas.
+  const stdout =
+    "\x1b[1m\x1b[92mversion:\x1b[0m 0.6.0\n" +
+    "\x1b[1m\x1b[92mlicense:\x1b[0m MIT\n";
+  assert.equal(parseCargoInfoVersion(stdout), "0.6.0");
+});
+
 test("asyncPool preserves input order", async () => {
   // Reverse-correlate delay with index so a naive implementation that
   // assigned results in completion order would scramble the output.