Only key by Cargo.toml and Cargo.lock files of workspace members

[max-heller]

Currently, we glob for all Cargo.toml and Cargo.lock files anywhere in a workspace, but this can pick up false positives (see #179). This PR switches to only using Cargo.toml files of workspace members (determined using cargo metadata --no-deps) and per-workspace Cargo.lock files.

Closes #179

[Swatinem]

this looks good, in theory.
however previously we had some problems with cargo metadata building everything within the workspace eagerly (on cache "restore"), which negated the whole purpose of the cache.

I’m wondering if the --no-deps flag might change that behavior or not, or if a more uptodate version of cargo does not suffer from this. But I am very reluctant to try and find out. Let me run a couple of tests for this, as the problem with cargo metadata was reproducible on https://github.com/getsentry/relay, and I can try with that on monday.

[max-heller]

however previously we had some problems with cargo metadata building everything within the workspace eagerly (on cache "restore"), which negated the whole purpose of the cache.

I’m wondering if the --no-deps flag might change that behavior or not

My guess is that it wouldn't be building anything, but downloading dependencies from the registry to analyze their manifests. The documentation for --no-deps says it "[doesn't] fetch dependencies", which sounds like what we want.

[max-heller]

the problem with cargo metadata was reproducible on https://github.com/getsentry/relay, and I can try with that on monday

Did you get a chance to test this?

[Swatinem]

Sorry for the delay, I wasn’t able to reproduce the original problem with cargo metadata locally. Even back then it wasn’t so easy to reproduce I remember. Maybe in the meantime things might have changed. I will merge this and then do some tests in CI.