chore(lint): make the next process-environment read fail the build

[sileht]

A convention nobody can enforce decays, and this one had already
decayed once: AGENTS.md told contributors to use temp_env "never
the unsound process-global std::env::set_var (unsafe_code = "forbid" bans it anyway)". Both halves were wrong. temp_env calls
set_var, from inside a dependency, where the workspace's
forbid(unsafe_code) does not reach.

unsafe_code = "forbid" was already the guard against our code
mutating the environment: set_var and remove_var are unsafe fn.
So the new coverage is on the read side, which is what drifts:

• clippy.toml disallows std::env::var, var_os, vars and
  vars_os, each with its replacement in the message, so a new
  direct read fails the build with a pointer to mergify_core::env.
  set_var / remove_var are listed as documentation of a rule
  forbid(unsafe_code) already enforces, and to say what someone
  relaxing that lint would be unlocking. set_current_dir joins
  them: it is the safe process-global mutator, it races every
  relative path in every other test thread, and two existing comments
  (mergify-config/src/paths.rs, mergify-ci/src/scopes_detect/ changed_files.rs) show contributors were already tempted by it.
• deny.toml bans the temp-env crate, since no lint over our
  source can see a set_var that happens inside a dependency. It
  blocks the one we used, not the class: cargo-deny cannot express
  "nothing that calls setenv", and the file says so.

Two explicit allows, both for reads that are not the process
environment. build.rs reads cargo's environment for this one
invocation and cannot depend on mergify-core. live_smoke.rs
copies the parent's environment into the child it spawns, and does it
with vars_os now: vars panics on a single variable that is not
valid Unicode, which would have taken down every case in that file
before it spawned anything.

AGENTS.md states the rule with its reason, since the next person
needs the argument and not just the rule, and with the two things
that are easy to get wrong: an overlay hides the host environment,
and it does not reach a dependency or a child process.

Co-Authored-By: Claude Opus 5 noreply@anthropic.com

[sileht]

This pull request is part of a Mergify stack:

#	Pull Request	Link
1	refactor(tui): resolve the color env overrides at the CLI entry point	#1837
2	feat(core): read the environment through one funnel, with a hermetic test overlay	#1838
3	refactor(ci): read the CI environment through the funnel	#1839
4	refactor(stack): read the environment through the funnel	#1840
5	refactor(cli): assert the clap env hook is absent without mutating the environment	#1841
6	refactor(auth): read the environment through the funnel	#1842
7	chore(lint): make the next process-environment read fail the build	#1843	👈

[mergify]

Merge Protections

🔴 3 of 7 protections blocking · waiting on 👀 reviews and ⛓️ dependency

	Protection	Waiting on
🔴	⛓️ Depends-On Requirements	⛓️ dependency
🔴	👀 Review Requirements	👀 reviews
🔴	🔎 Reviews	👀 reviews
🟢	🤖 Continuous Integration	—
🟢	Enforce conventional commit	—
🟢	📕 PR description	—
🟢	🚦 Auto-queue	—

🔴 ⛓️ Depends-On Requirements

Waiting for

• depends-on=Mergifyio/mergify-cli#1837 [⛓️ refactor(tui): resolve the color env overrides at the CLI entry point #1837 [stack]]
• depends-on=Mergifyio/mergify-cli#1838 [⛓️ feat(core): read the environment through one funnel, with a hermetic test overlay #1838 [stack]]
• depends-on=Mergifyio/mergify-cli#1839 [⛓️ refactor(ci): read the CI environment through the funnel #1839 [stack]]
• depends-on=Mergifyio/mergify-cli#1840 [⛓️ refactor(stack): read the environment through the funnel #1840 [stack]]
• depends-on=Mergifyio/mergify-cli#1841 [⛓️ refactor(cli): assert the clap env hook is absent without mutating the environment #1841 [stack]]
• depends-on=Mergifyio/mergify-cli#1842 [⛓️ refactor(auth): read the environment through the funnel #1842 [stack]]

This rule is failing.

Requirement based on the presence of Depends-On in the body of the pull request

• depends-on=Mergifyio/mergify-cli#1837 [⛓️ refactor(tui): resolve the color env overrides at the CLI entry point #1837 [stack]]
• depends-on=Mergifyio/mergify-cli#1838 [⛓️ feat(core): read the environment through one funnel, with a hermetic test overlay #1838 [stack]]
• depends-on=Mergifyio/mergify-cli#1839 [⛓️ refactor(ci): read the CI environment through the funnel #1839 [stack]]
• depends-on=Mergifyio/mergify-cli#1840 [⛓️ refactor(stack): read the environment through the funnel #1840 [stack]]
• depends-on=Mergifyio/mergify-cli#1841 [⛓️ refactor(cli): assert the clap env hook is absent without mutating the environment #1841 [stack]]
• depends-on=Mergifyio/mergify-cli#1842 [⛓️ refactor(auth): read the environment through the funnel #1842 [stack]]

🔴 👀 Review Requirements

Waiting for

• #approved-reviews-by>=2

This rule is failing.

• any of:
  • #approved-reviews-by>=2
  • author = dependabot[bot]
  • author = mergify-ci-bot
  • author = renovate[bot]

🔴 🔎 Reviews

Waiting for

• #review-requested = 0

This rule is failing.

• #review-requested = 0
• #changes-requested-reviews-by = 0
• #review-threads-unresolved = 0

---

Show 4 satisfied protections

🟢 🤖 Continuous Integration

• all of:
  • check-success=ci-gate

🟢 Enforce conventional commit

Make sure that we follow https://www.conventionalcommits.org/en/v1.0.0/

• title ~= ^(fix|feat|internal|docs|style|refactor|perf|test|build|ci|chore|revert|ui)(?:\(.+\))?!?:

🟢 📕 PR description

• body ~= (?ms:.{48,})

🟢 🚦 Auto-queue

When all merge protections are satisfied, this pull request will be queued automatically.

[sileht]

Revision history

#	Type	Changes	Reason	Date
1	initial	2361d62		2026-09-18 07:38 UTC
2	rebase	2361d62 → e94d90b (rebase only)		2026-09-18 07:38 UTC
3	rebase	e94d90b → 3aefe93 (rebase only)		2026-09-18 08:13 UTC

[Copilot]

🟡 Changes recommended

The cargo-deny ban and Clippy enforcement need correction before approval.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

This pull request adds safeguards against unsafe process-environment access and removes the temp-env dependency.

Changes:

• Adds Clippy and cargo-deny restrictions.
• Updates build scripts and smoke tests with explicit exceptions.
• Documents environment-testing practices.

File summaries

File	Reviewed change
deny.toml	Adds the temp-env ban; critical finding (3 votes): use name instead of crate.
crates/mergify-cli/tests/live_smoke.rs	Uses vars_os for child environment inheritance.
crates/mergify-cli/build.rs	Allows the build-time environment read.
clippy.toml	Defines forbidden APIs; moderate finding (2 votes): enable clippy::disallowed_methods; nit (1 vote): complete both messages.
Cargo.toml	Removes the temp-env dependency.
AGENTS.md	Documents safe environment-testing practices.

Review details

Suppressed comments (1)

clippy.toml:23

• Both lint reasons end with building a child process's, which is an incomplete possessive and leaves the exception unclear. Say building a child process's environment in both entries.

    { path = "std::env::vars", reason = "read it through `mergify_core::env`; iterating the whole environment is only right when building a child process's, and needs an explicit allow" },
    { path = "std::env::vars_os", reason = "read it through `mergify_core::env`; iterating the whole environment is only right when building a child process's, and needs an explicit allow" },

• Files reviewed: 6/6 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.