refactor(rust): reduce workspace clippy warning noise

Author: linuxdevel

Cargo.lock

@@ -25,6 +25,7 @@ tracing = { workspace = true }
 
 [dev-dependencies]
 tempfile = "3"
+temp-env = "0.3"
 
 [lints]
 workspace = true

crates/openshell-bootstrap/Cargo.toml

@@ -304,22 +304,25 @@ pub async fn find_gateway_container(docker: &Docker, port: Option<u16>) -> Resul
 
     let matches: Vec<String> = containers
         .iter()
-        .filter(|c| is_gateway_image(c) && port.map_or(true, |p| has_port(c, p)))
+        .filter(|c| is_gateway_image(c) && port.is_none_or(|p| has_port(c, p)))
         .filter_map(container_name)
         .collect();
 
     match matches.len() {
         0 => {
-            let hint = if let Some(p) = port {
-                format!(
-                    "No openshell gateway container found listening on port {p}.\n\
+            let hint = port.map_or_else(
+                || {
+                    "No openshell gateway container found.\n\
                      Is the gateway running? Check with: docker ps"
-                )
-            } else {
-                "No openshell gateway container found.\n\
-                 Is the gateway running? Check with: docker ps"
-                    .to_string()
-            };
+                        .to_string()
+                },
+                |p| {
+                    format!(
+                        "No openshell gateway container found listening on port {p}.\n\
+                         Is the gateway running? Check with: docker ps"
+                    )
+                },
+            );
             Err(miette::miette!("{hint}"))
         }
         1 => Ok(matches.into_iter().next().unwrap()),
@@ -748,22 +751,22 @@ pub async fn check_port_conflicts(
 
         let ports = container.ports.as_deref().unwrap_or_default();
         for port in ports {
-            if let Some(public) = port.public_port {
-                if needed_ports.contains(&public) {
-                    let cname = names
-                        .first()
-                        .map(|n| n.trim_start_matches('/').to_string())
-                        .unwrap_or_else(|| {
-                            container
-                                .id
-                                .clone()
-                                .unwrap_or_else(|| "<unknown>".to_string())
-                        });
-                    conflicts.push(PortConflict {
-                        container_name: cname,
-                        host_port: public,
-                    });
-                }
+            if let Some(public) = port.public_port
+                && needed_ports.contains(&public)
+            {
+                let cname = names.first().map_or_else(
+                    || {
+                        container
+                            .id
+                            .clone()
+                            .unwrap_or_else(|| "<unknown>".to_string())
+                    },
+                    |n| n.trim_start_matches('/').to_string(),
+                );
+                conflicts.push(PortConflict {
+                    container_name: cname,
+                    host_port: public,
+                });
             }
         }
     }
@@ -1091,6 +1094,7 @@ fn is_port_conflict(err: &BollardError) -> bool {
 #[cfg(test)]
 mod tests {
     use super::*;
+    use temp_env::with_var;
 
     #[test]
     fn normalize_arch_x86_64() {
@@ -1152,36 +1156,22 @@ mod tests {
     #[test]
     fn docker_not_reachable_error_with_docker_host() {
         // Simulate: DOCKER_HOST is set but daemon unresponsive.
-        // We set the env var temporarily (this is test-only).
-        let prev_docker_host = std::env::var("DOCKER_HOST").ok();
-        // SAFETY: test-only, single-threaded test runner for this test
-        unsafe {
-            std::env::set_var("DOCKER_HOST", "unix:///tmp/fake-docker.sock");
-        }
-
-        let err = docker_not_reachable_error(
-            "daemon not responding",
-            "Docker socket exists but the daemon is not responding",
-        );
-        let msg = format!("{err:?}");
-
-        // Restore env
-        // SAFETY: test-only, restoring previous state
-        unsafe {
-            match prev_docker_host {
-                Some(val) => std::env::set_var("DOCKER_HOST", val),
-                None => std::env::remove_var("DOCKER_HOST"),
-            }
-        }
+        with_var("DOCKER_HOST", Some("unix:///tmp/fake-docker.sock"), || {
+            let err = docker_not_reachable_error(
+                "daemon not responding",
+                "Docker socket exists but the daemon is not responding",
+            );
+            let msg = format!("{err:?}");
 
-        assert!(
-            msg.contains("DOCKER_HOST"),
-            "should mention DOCKER_HOST when it is set"
-        );
-        assert!(
-            msg.contains("unix:///tmp/fake-docker.sock"),
-            "should show the current DOCKER_HOST value"
-        );
+            assert!(
+                msg.contains("DOCKER_HOST"),
+                "should mention DOCKER_HOST when it is set"
+            );
+            assert!(
+                msg.contains("unix:///tmp/fake-docker.sock"),
+                "should show the current DOCKER_HOST value"
+            );
+        });
     }
 
     #[test]

crates/openshell-bootstrap/src/docker.rs

@@ -305,8 +305,8 @@ where
     }
 
     // Ensure the image is available on the target Docker daemon
+    log("[status] Downloading gateway".to_string());
     if remote_opts.is_some() {
-        log("[status] Downloading gateway".to_string());
         let on_log_clone = Arc::clone(&on_log);
         let progress_cb = move |msg: String| {
             if let Ok(mut f) = on_log_clone.lock() {
@@ -323,7 +323,6 @@ where
         .await?;
     } else {
         // Local deployment: ensure image exists (pull if needed)
-        log("[status] Downloading gateway".to_string());
         ensure_image(
             &target_docker,
             &image_ref,
@@ -662,16 +661,16 @@ pub async fn gateway_container_logs<W: std::io::Write>(
     Ok(())
 }
 
-/// Fetch the last `n` lines of container logs for a local gateway as a
-/// `String`.  This is a convenience wrapper for diagnostic call sites (e.g.
-/// failure diagnosis in the CLI) that do not hold a Docker client handle.
+/// Fetch the last `n` lines of container logs for a local gateway as a `String`.
+///
+/// This is a convenience wrapper for diagnostic call sites (e.g. failure
+/// diagnosis in the CLI) that do not hold a Docker client handle.
 ///
 /// Returns an empty string on any Docker/connection error so callers don't
 /// need to worry about error handling.
 pub async fn fetch_gateway_logs(name: &str, n: usize) -> String {
-    let docker = match Docker::connect_with_local_defaults() {
-        Ok(d) => d,
-        Err(_) => return String::new(),
+    let Ok(docker) = Docker::connect_with_local_defaults() else {
+        return String::new();
     };
     let container = container_name(name);
     fetch_recent_logs(&docker, &container, n).await

crates/openshell-bootstrap/src/lib.rs

@@ -1,7 +1,7 @@
 // SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 // SPDX-License-Identifier: Apache-2.0
 
-//! Configuration management for OpenShell components.
+//! Configuration management for `OpenShell` components.
 
 use serde::{Deserialize, Serialize};
 use std::net::SocketAddr;
@@ -39,7 +39,7 @@ pub struct Config {
     #[serde(default)]
     pub sandbox_image_pull_policy: String,
 
-    /// gRPC endpoint for sandboxes to connect back to OpenShell.
+    /// gRPC endpoint for sandboxes to connect back to `OpenShell`.
     /// Used by sandbox pods to fetch their policy at startup.
     #[serde(default)]
     pub grpc_endpoint: String,

crates/openshell-core/src/config.rs

@@ -1,15 +1,15 @@
 // SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 // SPDX-License-Identifier: Apache-2.0
 
-//! Common error types for OpenShell.
+//! Common error types for `OpenShell`.
 
 use miette::Diagnostic;
 use thiserror::Error;
 
-/// Result type alias using OpenShell's error type.
+/// Result type alias using `OpenShell`'s error type.
 pub type Result<T> = std::result::Result<T, Error>;
 
-/// OpenShell error type.
+/// `OpenShell` error type.
 #[derive(Debug, Error, Diagnostic)]
 pub enum Error {
     /// Configuration error.

crates/openshell-core/src/error.rs

@@ -135,18 +135,17 @@ pub fn pid_matches_forward(pid: u32, port: u16, sandbox_id: Option<&str>) -> boo
 /// match is expected.
 pub fn find_forward_by_port(port: u16) -> Result<Option<String>> {
     let dir = forward_pid_dir()?;
-    let entries = match std::fs::read_dir(&dir) {
-        Ok(e) => e,
-        Err(_) => return Ok(None),
+    let Ok(entries) = std::fs::read_dir(&dir) else {
+        return Ok(None);
     };
     let suffix = format!("-{port}.pid");
     for entry in entries.flatten() {
         let file_name = entry.file_name();
         let file_name = file_name.to_string_lossy();
-        if let Some(name) = file_name.strip_suffix(&suffix) {
-            if !name.is_empty() {
-                return Ok(Some(name.to_string()));
-            }
+        if let Some(name) = file_name.strip_suffix(&suffix)
+            && !name.is_empty()
+        {
+            return Ok(Some(name.to_string()));
         }
     }
     Ok(None)
@@ -671,9 +670,8 @@ mod tests {
         // `python3 -m http.server` which listens on [::] by default.  The
         // IPv4-only TcpListener::bind("127.0.0.1", port) might succeed, but
         // lsof should detect the listener and the check should still fail.
-        let listener = match TcpListener::bind("[::]:0") {
-            Ok(l) => l,
-            Err(_) => return, // IPv6 not available, skip
+        let Ok(listener) = TcpListener::bind("[::]:0") else {
+            return; // IPv6 not available, skip
         };
         let port = listener.local_addr().unwrap().port();
 

crates/openshell-core/src/forward.rs

@@ -105,17 +105,17 @@ pub fn profile_for(provider_type: &str) -> Option<&'static InferenceProviderProf
 /// need the auth/header information (e.g. the sandbox bundle-to-route
 /// conversion).
 pub fn auth_for_provider_type(provider_type: &str) -> (AuthHeader, Vec<(String, String)>) {
-    match profile_for(provider_type) {
-        Some(profile) => {
+    profile_for(provider_type).map_or_else(
+        || (AuthHeader::Bearer, Vec::new()),
+        |profile| {
             let headers = profile
                 .default_headers
                 .iter()
                 .map(|(k, v)| ((*k).to_string(), (*v).to_string()))
                 .collect();
             (profile.auth.clone(), headers)
-        }
-        None => (AuthHeader::Bearer, Vec::new()),
-    }
+        },
+    )
 }
 
 // ---------------------------------------------------------------------------

crates/openshell-core/src/inference.rs

@@ -1,7 +1,7 @@
 // SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 // SPDX-License-Identifier: Apache-2.0
 
-//! OpenShell Core - shared library for OpenShell components.
+//! `OpenShell` Core - shared library for `OpenShell` components.
 //!
 //! This crate provides:
 //! - Protocol buffer definitions and generated code