cargo updates git repository on any action when using a tag

[konstin]

Problem

ruff uses multiple git dependencies. One of them, unicode_names2, is a transitive dependency used with a git tag:

[[package]]
name = "rustpython-parser"
version = "0.2.0"
source = "git+https://github.com/RustPython/RustPython.git?rev=aa8336ee94492b52458ed8e1517238e5c6c2914c#aa8336ee94492b52458ed8e1517238e5c6c2914c"
dependencies = [
 # [...]
 "unicode_names2",
]

[[package]]
name = "unicode_names2"
version = "0.6.0"
source = "git+https://github.com/youknowone/unicode_names2.git?tag=v0.6.0+character-alias#4ce16aa85cbcdd9cc830410f1a72ef9a235f2fde"
dependencies = [
 "phf",
]

This will updates the git repository on any actions:

$ git clone https://github.com/charliermarsh/ruff && cd ruff && git checkout 3ed539d50ed6260358c97d2e00b49bad4abfa37e
$ cargo check
    Updating git repository `https://github.com/youknowone/unicode_names2.git`
    Finished dev [unoptimized + debuginfo] target(s) in 0.42s
$ cargo check
    Updating git repository `https://github.com/youknowone/unicode_names2.git`
    Finished dev [unoptimized + debuginfo] target(s) in 0.27s

Running with CARGO_LOG=cargo=debug cargo check says the following:

[...]
[2023-03-02T18:07:36Z DEBUG cargo::core::registry] load/missing  https://github.com/youknowone/unicode_names2.git?tag=v0.6.0+character-alias
[2023-03-02T18:07:36Z DEBUG cargo::core::registry] loading source https://github.com/youknowone/unicode_names2.git?tag=v0.6.0+character-alias
[2023-03-02T18:07:36Z DEBUG cargo::sources::config] loading: https://github.com/youknowone/unicode_names2.git?tag=v0.6.0+character-alias
    Updating git repository `https://github.com/youknowone/unicode_names2.git`
[...]

Steps

git clone https://github.com/charliermarsh/ruff
cd ruff && git checkout 3ed539d50ed6260358c97d2e00b49bad4abfa37e
cargo check

Reproduced on ubuntu 20.04

Possible Solution(s)

I would prefer it if cargo check and cargo build used the local checkout instead of checking the repo even when using a tag.

Notes

See RustPython/RustPython#4617 for our current workaround

Version

Tested on ubuntu and mac os.

$ cargo version --verbose
cargo 1.67.0 (8ecd4f20a 2023-01-10)
release: 1.67.0
commit-hash: 8ecd4f20a9efb626975ac18a016d480dc7183d9b
commit-date: 2023-01-10
host: x86_64-unknown-linux-gnu
libgit2: 1.5.0 (sys:0.16.0 vendored)
libcurl: 7.86.0-DEV (sys:0.4.59+curl-7.86.0 vendored ssl:OpenSSL/1.1.1q)
os: Ubuntu 20.04 (focal) [64-bit]

cargo 1.67.1 (8ecd4f20a 2023-01-10)
release: 1.67.1
commit-hash: 8ecd4f20a9efb626975ac18a016d480dc7183d9b
commit-date: 2023-01-10
host: aarch64-apple-darwin
libgit2: 1.5.0 (sys:0.16.0 vendored)
libcurl: 7.79.1 (sys:0.4.59+curl-7.86.0 system ssl:(SecureTransport) LibreSSL/3.3.6)
os: Mac OS 12.6.0 [64-bit]

[weihanglo]

Thanks for the detailed report!

This looks like a duplicate of #11085, and #11086 was an attempt to fix that. Since the fix could lead to an incompatible version bump in Cargo.lock, we are going to collect as many lockfile breaking changes as possible and make them into a single bump.

In the meanwhile, to circumvent this, I'd suggest avoiding characters that involve in encoding/decoding of tag or branch name. Sorry for the inconvenience 😞.

[weihanglo]

Going to close this as it is a duplicate of #11085. Let us know if it is wrong and we can consider a reopen. Thank you.