Allow to filter packages by registry, when upgrading them

[aleksanderkrauze]

Problem statement

When working with private cargo registries I want to be able to scope packages I want to upgrade to ones from specific registry.

For example if at work I use private registry for internal libraries I would want to upgrade internal libraries separately from crates.io dependencies. Such ability would be especially useful in CI to automatically create issues or PRs when internal library has new version released.

Proposal

I want to add --registry flag to cargo-upgrade (in dependencies section). It should take as an argument a <name> which is defined in [registries] table in cargo configuration. By specifying this flag only crates from this registry will be considered when running any cargo-upgrade commands. The flag can be passed multiple times to specify a list of registries.

Open Questions

• How to allow enabling default registry? Should --registry flag treat crates-io as a special value? Or maybe there should be --default-registry flag?
• How should this work together with source replacement?
• Should sources defined in source.<name>.registry be allowed as --registry flag values?

Prior art

I am not aware of any cargo plugin, which would allow for filtering on registry basis.

Tracking issue for upgrades in the cargo upstream also does not include such functionality (see rust-lang/cargo#12425). Although in the end I think this should be added to the upstream, it is probably better to implement this here first.

Implementation

If this issue gets accepted, I am ready to implement it.

[epage]

On our own, we can only do this for version requirements. When cargo-upgrade would call cargo-update, it won't work.

Could you go into more detail about the underlying need driving this?

For example, understanding the need allows us to explore related ideas like cargo's per-registry min-publish-age:
https://doc.rust-lang.org/nightly/cargo/reference/unstable.html#min-publish-age