Add Rust dependency hygiene CI

.github/workflows/dependency-hygiene.yml

@@ -0,0 +1,149 @@
+name: Dependency hygiene
+
+# GitHub Actions is public mirror validation only.
+# Primary registry release evidence must be produced on Russian build-runner.
+
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+  schedule:
+    - cron: "17 2 * * 1"
+
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+  unused-dependencies:
+    name: Unused dependency check
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        shell: bash
+        working-directory: adk-rust
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          lfs: false
+
+      - name: Install stable Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Install cargo-machete
+        run: cargo install cargo-machete --locked
+
+      - name: cargo metadata
+        run: cargo metadata --locked --format-version 1 > /tmp/aw-rus-cargo-metadata.json
+
+      - name: cargo machete
+        run: cargo machete --with-metadata
+
+      - name: Ensure cargo-machete metadata did not rewrite manifests
+        working-directory: .
+        run: git diff --exit-code -- adk-rust/Cargo.lock adk-rust/Cargo.toml adk-rust/crates
+
+      - name: Require explicit justification for cargo-machete ignores
+        working-directory: .
+        run: |
+          python3 - <<'PY'
+          from pathlib import Path
+
+          failures = []
+          for path in Path("adk-rust").rglob("Cargo.toml"):
+              lines = path.read_text(encoding="utf-8").splitlines()
+              in_machete = False
+              for idx, line in enumerate(lines):
+                  stripped = line.strip()
+                  if stripped.startswith("[") and stripped.endswith("]"):
+                      in_machete = stripped == "[package.metadata.cargo-machete]"
+                      continue
+                  if not in_machete or not stripped.startswith("ignored"):
+                      continue
+                  same_line_comment = "#" in line and line.split("#", 1)[1].strip()
+                  prev_comment = idx > 0 and lines[idx - 1].strip().startswith("#")
+                  if not same_line_comment and not prev_comment:
+                      failures.append(f"{path}:{idx + 1}")
+
+          if failures:
+              print("cargo-machete ignored entries require an adjacent TOML comment explaining why the dependency is intentionally kept:")
+              for item in failures:
+                  print(f"  {item}")
+              raise SystemExit(1)
+          PY
+
+  dependency-tree:
+    name: Dependency duplicate report
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        shell: bash
+        working-directory: adk-rust
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          lfs: false
+
+      - name: Install stable Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: cargo tree duplicates
+        run: cargo tree --duplicates --locked
+
+  dependency-security:
+    name: Dependency security policy
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          lfs: false
+
+      - name: Install stable Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Install cargo-audit
+        uses: taiki-e/install-action@cargo-audit
+
+      - name: Install cargo-deny
+        uses: taiki-e/install-action@cargo-deny
+
+      - name: cargo audit
+        working-directory: adk-rust
+        run: cargo audit --deny warnings
+
+      - name: cargo deny
+        run: |
+          cargo deny --manifest-path adk-rust/Cargo.toml check \
+            --config deny.toml \
+            --hide-inclusion-graph \
+            --show-stats
+
+  cargo-udeps-nightly:
+    name: Cargo udeps nightly advisory
+    runs-on: ubuntu-latest
+    continue-on-error: true
+    if: github.event_name == 'workflow_dispatch' || github.event_name == 'schedule'
+    defaults:
+      run:
+        shell: bash
+        working-directory: adk-rust
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          lfs: false
+
+      - name: Install nightly Rust
+        uses: dtolnay/rust-toolchain@nightly
+
+      - name: Install cargo-udeps
+        run: cargo install cargo-udeps --locked
+
+      - name: cargo udeps
+        run: cargo +nightly udeps --workspace --all-targets

adk-rust/Cargo.lock

@@ -201,7 +201,6 @@ dependencies = [
  "clap",
  "reqwest",
  "serde_json",
- "tempfile",
 ]
 
 [[package]]
@@ -248,7 +247,6 @@ dependencies = [
  "anyhow",
  "reqwest",
  "serde_json",
- "tempfile",
 ]
 
 [[package]]
@@ -457,7 +455,6 @@ dependencies = [
  "clap",
  "reqwest",
  "serde_json",
- "tempfile",
 ]
 
 [[package]]
@@ -469,7 +466,6 @@ dependencies = [
  "clap",
  "reqwest",
  "serde_json",
- "tempfile",
 ]
 
 [[package]]
@@ -785,7 +781,6 @@ dependencies = [
  "anyhow",
  "chrono",
  "clap",
- "tempfile",
 ]
 
 [[package]]
@@ -1929,7 +1924,6 @@ dependencies = [
  "reqwest",
  "serde",
  "serde_json",
- "tempfile",
 ]
 
 [[package]]

adk-rust/crates/aw-contour-smoke/Cargo.toml

@@ -11,6 +11,3 @@ anyhow.workspace = true
 clap.workspace = true
 reqwest.workspace = true
 serde_json.workspace = true
-
-[dev-dependencies]
-tempfile.workspace = true

adk-rust/crates/aw-health-check/Cargo.toml

@@ -10,6 +10,3 @@ publish.workspace = true
 anyhow.workspace = true
 reqwest.workspace = true
 serde_json.workspace = true
-
-[dev-dependencies]
-tempfile.workspace = true

adk-rust/crates/check-aw-data/Cargo.toml

@@ -12,6 +12,3 @@ chrono.workspace = true
 clap.workspace = true
 reqwest.workspace = true
 serde_json.workspace = true
-
-[dev-dependencies]
-tempfile.workspace = true

adk-rust/crates/check-aw-full/Cargo.toml

@@ -12,6 +12,3 @@ chrono.workspace = true
 clap.workspace = true
 reqwest.workspace = true
 serde_json.workspace = true
-
-[dev-dependencies]
-tempfile.workspace = true

adk-rust/crates/diag-and-manual-restart/Cargo.toml

@@ -10,6 +10,3 @@ publish.workspace = true
 anyhow.workspace = true
 chrono.workspace = true
 clap.workspace = true
-
-[dev-dependencies]
-tempfile.workspace = true

adk-rust/crates/rdp-worktime-report/Cargo.toml

@@ -13,6 +13,3 @@ clap.workspace = true
 reqwest.workspace = true
 serde.workspace = true
 serde_json.workspace = true
-
-[dev-dependencies]
-tempfile.workspace = true