Support retrieving workspace of path dependencies in cargo

[Jefffrey]

What are you trying to accomplish?

Given a repository like so:

.
├── cli_crate
│   ├── Cargo.toml
└── workspace
    ├── Cargo.toml
    └── nested
        └── Cargo.toml

Where workspace represents a workspace containing only nested, and cli_crate has a path dependency to nested, and nested inherits any property from the root (e.g. edition = { workspace = true }).

If we point dependabot to only cli_crate, it will error out when running cargo update as though it can fetch the path dependency nested, it cannot resolve this as it also needs the workspace due to this inheritance. Fix Cargo file_fetcher to support this logic of locating the root of a workspace member who is a path dependency, and fetching it.

For negative cases, where the root cannot be located or is incorrect, emit an error message (instead of when running cargo update which can be confusing to understand).

Closes #9533

Anything you want to highlight for special attention from reviewers?

How will you know you've accomplished your goal?

Unit tests added (see reference repository: https://github.com/Jefffrey/dependabot-cargo-test/tree/master)

Checklist

• I have run the complete test suite to ensure all tests and linters pass.
• I have thoroughly tested my code changes to ensure they work as expected, including adding additional tests for new functionality.
• I have written clear and descriptive commit messages.
• I have provided a detailed description of the changes in the pull request, including the problem it addresses, how it fixes the problem, and any relevant details about the implementation.
• I have ensured that the code is well-documented and easy to understand.

[Jefffrey]

Small typo (I assume?) I found when looking at #7649 for reference

[abdulapopoola]

Approving based on @RobJellinghaus ' approval :)

[RobJellinghaus]

Approving based on @RobJellinghaus ' approval :)

Thanks Abdul! Sorry I don't have approver ability myself for some reason, let me know if you can diagnose that. Thanks @Jefffrey for this work! Do you have any other Rust Dependabot issues you are looking at?

[abdulapopoola]

Thanks so much @Jefffrey !

[Jefffrey]

Thanks for the review 👍

Do you have any other Rust Dependabot issues you are looking at?

This was the only one I was looking at

[mistydemeo]

This led to a regression that causes Dependabot runs to fail in multi-package Cargo workspaces - see #10584. Any chance this could either get reverted or fixed forward?

[Jefffrey]

This led to a regression that causes Dependabot runs to fail in multi-package Cargo workspaces - see #10584. Any chance this could either get reverted or fixed forward?

Sorry about this! I've raised a PR to revert these changes: #10599