hermeto/core/package_managers/pip/rust.py (2)

53-66: Depth heuristic and docstring nits

• Use parents-count with a deterministic tiebreaker for stability across absolute/relative paths.
• Soften the “always” claim in the docstring.

 def _get_rust_root_dir(cargo_lockfiles: Iterable[Path]) -> Path:
     """Find the top-most Cargo.lock in the package.

     NOTE: This is not necessarily the most accurate solution, but this heuristic has proven to work
     on the most popular python packages with rust dependencies. A repository may have multiple
     Cargo.toml files (e.g. workspace), but we are mostly interested in Cargo.lock file.

-    Also, on the same level as Cargo.lock file, there is always a Cargo.toml file.
+    Also, on the same level as Cargo.lock file, there is typically a Cargo.toml file.

     If this solution is not accurate enough, then we would probably need to check for the manifest
     path in pyproject.toml config section for maturin or setuptools-rust.
     """
-    return min(cargo_lockfiles, key=lambda x: len(x.parts)).parent
+    # Prefer the shallowest lockfile; break ties deterministically.
+    return min(cargo_lockfiles, key=lambda p: (len(p.parents), str(p))).parent

---

88-90: Scan for Cargo.lock after confirming Rust deps; constrain search to source_dir

This avoids unnecessary filesystem walks and reduces false positives from unrelated lockfiles elsewhere in the tarball.

-        cargo_lockfiles = list(extract_dir.rglob("Cargo.lock"))
-        if not cargo_lockfiles:
-            shutil.rmtree(extract_dir, ignore_errors=True)
-            continue
@@
         if not _depends_on_rust(source_dir):
             shutil.rmtree(extract_dir, ignore_errors=True)
             continue
+        # Only search within the detected project root to avoid stray lockfiles.
+        cargo_lockfiles = list(source_dir.rglob("Cargo.lock"))
+        if not cargo_lockfiles:
+            log.debug("No Cargo.lock under %s; skipping.", source_dir)
+            shutil.rmtree(extract_dir, ignore_errors=True)
+            continue

Please verify this reordering doesn’t miss any packages you expect to handle (e.g., libs that ship Rust but omit Cargo.lock).

Also applies to: 102-106

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro