From 2e1fe8618c804ec928c1e180dc5246017d9d4a0e Mon Sep 17 00:00:00 2001 From: igor04091968 Date: Wed, 1 Jul 2026 07:19:07 +0300 Subject: [PATCH] Add Rust dependency hygiene CI --- .github/workflows/dependency-hygiene.yml | 149 ++++++++++++++++++ adk-rust/Cargo.lock | 6 - adk-rust/crates/aw-contour-smoke/Cargo.toml | 3 - adk-rust/crates/aw-health-check/Cargo.toml | 3 - adk-rust/crates/check-aw-data/Cargo.toml | 3 - adk-rust/crates/check-aw-full/Cargo.toml | 3 - .../crates/diag-and-manual-restart/Cargo.toml | 3 - .../crates/rdp-worktime-report/Cargo.toml | 3 - 8 files changed, 149 insertions(+), 24 deletions(-) create mode 100644 .github/workflows/dependency-hygiene.yml diff --git a/.github/workflows/dependency-hygiene.yml b/.github/workflows/dependency-hygiene.yml new file mode 100644 index 0000000..163b9d8 --- /dev/null +++ b/.github/workflows/dependency-hygiene.yml @@ -0,0 +1,149 @@ +name: Dependency hygiene + +# GitHub Actions is public mirror validation only. +# Primary registry release evidence must be produced on Russian build-runner. + +on: + push: + pull_request: + workflow_dispatch: + schedule: + - cron: "17 2 * * 1" + +permissions: + contents: read + pull-requests: read + +jobs: + unused-dependencies: + name: Unused dependency check + runs-on: ubuntu-latest + defaults: + run: + shell: bash + working-directory: adk-rust + steps: + - name: Checkout + uses: actions/checkout@v4 + with: + lfs: false + + - name: Install stable Rust + uses: dtolnay/rust-toolchain@stable + + - name: Install cargo-machete + run: cargo install cargo-machete --locked + + - name: cargo metadata + run: cargo metadata --locked --format-version 1 > /tmp/aw-rus-cargo-metadata.json + + - name: cargo machete + run: cargo machete --with-metadata + + - name: Ensure cargo-machete metadata did not rewrite manifests + working-directory: . + run: git diff --exit-code -- adk-rust/Cargo.lock adk-rust/Cargo.toml adk-rust/crates + + - name: Require explicit justification for cargo-machete ignores + working-directory: . + run: | + python3 - <<'PY' + from pathlib import Path + + failures = [] + for path in Path("adk-rust").rglob("Cargo.toml"): + lines = path.read_text(encoding="utf-8").splitlines() + in_machete = False + for idx, line in enumerate(lines): + stripped = line.strip() + if stripped.startswith("[") and stripped.endswith("]"): + in_machete = stripped == "[package.metadata.cargo-machete]" + continue + if not in_machete or not stripped.startswith("ignored"): + continue + same_line_comment = "#" in line and line.split("#", 1)[1].strip() + prev_comment = idx > 0 and lines[idx - 1].strip().startswith("#") + if not same_line_comment and not prev_comment: + failures.append(f"{path}:{idx + 1}") + + if failures: + print("cargo-machete ignored entries require an adjacent TOML comment explaining why the dependency is intentionally kept:") + for item in failures: + print(f" {item}") + raise SystemExit(1) + PY + + dependency-tree: + name: Dependency duplicate report + runs-on: ubuntu-latest + defaults: + run: + shell: bash + working-directory: adk-rust + steps: + - name: Checkout + uses: actions/checkout@v4 + with: + lfs: false + + - name: Install stable Rust + uses: dtolnay/rust-toolchain@stable + + - name: cargo tree duplicates + run: cargo tree --duplicates --locked + + dependency-security: + name: Dependency security policy + runs-on: ubuntu-latest + defaults: + run: + shell: bash + steps: + - name: Checkout + uses: actions/checkout@v4 + with: + lfs: false + + - name: Install stable Rust + uses: dtolnay/rust-toolchain@stable + + - name: Install cargo-audit + uses: taiki-e/install-action@cargo-audit + + - name: Install cargo-deny + uses: taiki-e/install-action@cargo-deny + + - name: cargo audit + working-directory: adk-rust + run: cargo audit --deny warnings + + - name: cargo deny + run: | + cargo deny --manifest-path adk-rust/Cargo.toml check \ + --config deny.toml \ + --hide-inclusion-graph \ + --show-stats + + cargo-udeps-nightly: + name: Cargo udeps nightly advisory + runs-on: ubuntu-latest + continue-on-error: true + if: github.event_name == 'workflow_dispatch' || github.event_name == 'schedule' + defaults: + run: + shell: bash + working-directory: adk-rust + steps: + - name: Checkout + uses: actions/checkout@v4 + with: + lfs: false + + - name: Install nightly Rust + uses: dtolnay/rust-toolchain@nightly + + - name: Install cargo-udeps + run: cargo install cargo-udeps --locked + + - name: cargo udeps + run: cargo +nightly udeps --workspace --all-targets diff --git a/adk-rust/Cargo.lock b/adk-rust/Cargo.lock index ccb303f..a9c739d 100644 --- a/adk-rust/Cargo.lock +++ b/adk-rust/Cargo.lock @@ -201,7 +201,6 @@ dependencies = [ "clap", "reqwest", "serde_json", - "tempfile", ] [[package]] @@ -248,7 +247,6 @@ dependencies = [ "anyhow", "reqwest", "serde_json", - "tempfile", ] [[package]] @@ -457,7 +455,6 @@ dependencies = [ "clap", "reqwest", "serde_json", - "tempfile", ] [[package]] @@ -469,7 +466,6 @@ dependencies = [ "clap", "reqwest", "serde_json", - "tempfile", ] [[package]] @@ -785,7 +781,6 @@ dependencies = [ "anyhow", "chrono", "clap", - "tempfile", ] [[package]] @@ -1929,7 +1924,6 @@ dependencies = [ "reqwest", "serde", "serde_json", - "tempfile", ] [[package]] diff --git a/adk-rust/crates/aw-contour-smoke/Cargo.toml b/adk-rust/crates/aw-contour-smoke/Cargo.toml index ddb16bb..208c405 100644 --- a/adk-rust/crates/aw-contour-smoke/Cargo.toml +++ b/adk-rust/crates/aw-contour-smoke/Cargo.toml @@ -11,6 +11,3 @@ anyhow.workspace = true clap.workspace = true reqwest.workspace = true serde_json.workspace = true - -[dev-dependencies] -tempfile.workspace = true diff --git a/adk-rust/crates/aw-health-check/Cargo.toml b/adk-rust/crates/aw-health-check/Cargo.toml index 4ee4a9e..039772d 100644 --- a/adk-rust/crates/aw-health-check/Cargo.toml +++ b/adk-rust/crates/aw-health-check/Cargo.toml @@ -10,6 +10,3 @@ publish.workspace = true anyhow.workspace = true reqwest.workspace = true serde_json.workspace = true - -[dev-dependencies] -tempfile.workspace = true diff --git a/adk-rust/crates/check-aw-data/Cargo.toml b/adk-rust/crates/check-aw-data/Cargo.toml index 0d74bf0..cad77a3 100644 --- a/adk-rust/crates/check-aw-data/Cargo.toml +++ b/adk-rust/crates/check-aw-data/Cargo.toml @@ -12,6 +12,3 @@ chrono.workspace = true clap.workspace = true reqwest.workspace = true serde_json.workspace = true - -[dev-dependencies] -tempfile.workspace = true diff --git a/adk-rust/crates/check-aw-full/Cargo.toml b/adk-rust/crates/check-aw-full/Cargo.toml index 152bff9..7850660 100644 --- a/adk-rust/crates/check-aw-full/Cargo.toml +++ b/adk-rust/crates/check-aw-full/Cargo.toml @@ -12,6 +12,3 @@ chrono.workspace = true clap.workspace = true reqwest.workspace = true serde_json.workspace = true - -[dev-dependencies] -tempfile.workspace = true diff --git a/adk-rust/crates/diag-and-manual-restart/Cargo.toml b/adk-rust/crates/diag-and-manual-restart/Cargo.toml index dc39575..46d34e0 100644 --- a/adk-rust/crates/diag-and-manual-restart/Cargo.toml +++ b/adk-rust/crates/diag-and-manual-restart/Cargo.toml @@ -10,6 +10,3 @@ publish.workspace = true anyhow.workspace = true chrono.workspace = true clap.workspace = true - -[dev-dependencies] -tempfile.workspace = true diff --git a/adk-rust/crates/rdp-worktime-report/Cargo.toml b/adk-rust/crates/rdp-worktime-report/Cargo.toml index 00a387f..da1e7d1 100644 --- a/adk-rust/crates/rdp-worktime-report/Cargo.toml +++ b/adk-rust/crates/rdp-worktime-report/Cargo.toml @@ -13,6 +13,3 @@ clap.workspace = true reqwest.workspace = true serde.workspace = true serde_json.workspace = true - -[dev-dependencies] -tempfile.workspace = true