Add Rust dependency hygiene CI

.github/workflows/dependency-hygiene.yml

@@ -0,0 +1,149 @@
+name: Dependency hygiene
+
+# GitHub Actions is public mirror validation only.
+# Primary registry release evidence must be produced on Russian build-runner.
+
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+  schedule:
+    - cron: "17 2 * * 1"
+
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+  unused-dependencies:
+    name: Unused dependency check
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        shell: bash
+        working-directory: adk-rust
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          lfs: false
+
+      - name: Install stable Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Install cargo-machete
+        run: cargo install cargo-machete --locked
+
+      - name: cargo metadata
+        run: cargo metadata --locked --format-version 1 > /tmp/aw-rus-cargo-metadata.json
+
+      - name: cargo machete
+        run: cargo machete --with-metadata
+
+      - name: Ensure cargo-machete metadata did not rewrite manifests
+        working-directory: .
+        run: git diff --exit-code -- adk-rust/Cargo.lock adk-rust/Cargo.toml adk-rust/crates
+
+      - name: Require explicit justification for cargo-machete ignores
+        working-directory: .
+        run: |
+          python3 - <<'PY'
+          from pathlib import Path
+
+          failures = []
+          for path in Path("adk-rust").rglob("Cargo.toml"):
+              lines = path.read_text(encoding="utf-8").splitlines()
+              in_machete = False
+              for idx, line in enumerate(lines):
+                  stripped = line.strip()
+                  if stripped.startswith("[") and stripped.endswith("]"):
+                      in_machete = stripped == "[package.metadata.cargo-machete]"
+                      continue
+                  if not in_machete or not stripped.startswith("ignored"):
+                      continue
+                  same_line_comment = "#" in line and line.split("#", 1)[1].strip()
+                  prev_comment = idx > 0 and lines[idx - 1].strip().startswith("#")
+                  if not same_line_comment and not prev_comment:
+                      failures.append(f"{path}:{idx + 1}")
+
+          if failures:
+              print("cargo-machete ignored entries require an adjacent TOML comment explaining why the dependency is intentionally kept:")
+              for item in failures:
+                  print(f"  {item}")
+              raise SystemExit(1)
+          PY
+
+  dependency-tree:
+    name: Dependency duplicate report
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        shell: bash
+        working-directory: adk-rust
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          lfs: false
+
+      - name: Install stable Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: cargo tree duplicates
+        run: cargo tree --duplicates --locked
+
+  dependency-security:
+    name: Dependency security policy
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          lfs: false
+
+      - name: Install stable Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Install cargo-audit
+        uses: taiki-e/install-action@cargo-audit
+
+      - name: Install cargo-deny
+        uses: taiki-e/install-action@cargo-deny
+
+      - name: cargo audit
+        working-directory: adk-rust
+        run: cargo audit --deny warnings
+
+      - name: cargo deny
+        run: |
+          cargo deny --manifest-path adk-rust/Cargo.toml check \
+            --config deny.toml \
+            --hide-inclusion-graph \
+            --show-stats
+
+  cargo-udeps-nightly:
+    name: Cargo udeps nightly advisory
+    runs-on: ubuntu-latest
+    continue-on-error: true
+    if: github.event_name == 'workflow_dispatch' || github.event_name == 'schedule'
+    defaults:
+      run:
+        shell: bash
+        working-directory: adk-rust
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          lfs: false
+
+      - name: Install nightly Rust
+        uses: dtolnay/rust-toolchain@nightly
+
+      - name: Install cargo-udeps
+        run: cargo install cargo-udeps --locked
+
+      - name: cargo udeps
+        run: cargo +nightly udeps --workspace --all-targets

adk-rust/Cargo.lock

@@ -198,12 +198,9 @@ name = "aw-contour-smoke"
 version = "0.1.0"
 dependencies = [
  "anyhow",
- "chrono",
  "clap",
  "reqwest",
  "serde_json",
- "tempfile",
- "url",
 ]
 
 [[package]]
@@ -250,7 +247,6 @@ dependencies = [
  "anyhow",
  "reqwest",
  "serde_json",
- "tempfile",
 ]
 
 [[package]]
@@ -459,7 +455,6 @@ dependencies = [
  "clap",
  "reqwest",
  "serde_json",
- "tempfile",
 ]
 
 [[package]]
@@ -471,7 +466,6 @@ dependencies = [
  "clap",
  "reqwest",
  "serde_json",
- "tempfile",
 ]
 
 [[package]]
@@ -561,18 +555,6 @@ version = "1.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1d07550c9036bf2ae0c684c4297d503f838287c83c53686d05370d0e139ae570"
 
-[[package]]
-name = "containment-engine"
-version = "0.1.0"
-dependencies = [
- "anyhow",
- "chrono",
- "clap",
- "serde",
- "serde_json",
- "sha2",
-]
-
 [[package]]
 name = "core-foundation-sys"
 version = "0.8.7"
@@ -710,7 +692,6 @@ version = "0.1.0"
 dependencies = [
  "anyhow",
  "clap",
- "serde_json",
 ]
 
 [[package]]
@@ -790,7 +771,6 @@ dependencies = [
  "anyhow",
  "clap",
  "detmir-state",
- "serde",
  "serde_json",
 ]
 
@@ -801,7 +781,6 @@ dependencies = [
  "anyhow",
  "chrono",
  "clap",
- "tempfile",
 ]
 
 [[package]]
@@ -1269,10 +1248,7 @@ dependencies = [
  "reqwest",
  "serde",
  "serde_json",
- "sha2",
  "tempfile",
- "urlencoding",
- "zip 2.4.2",
 ]
 
 [[package]]
@@ -1948,7 +1924,6 @@ dependencies = [
  "reqwest",
  "serde",
  "serde_json",
- "tempfile",
 ]
 
 [[package]]
@@ -2136,21 +2111,6 @@ dependencies = [
  "winapi-util",
 ]
 
-[[package]]
-name = "security-finding-inbox"
-version = "0.1.0"
-dependencies = [
- "anyhow",
- "chrono",
- "clap",
- "hayabusa-tools",
- "reqwest",
- "serde",
- "serde_json",
- "sha2",
- "tempfile",
-]
-
 [[package]]
 name = "semver"
 version = "1.0.28"
@@ -3323,7 +3283,6 @@ dependencies = [
  "tempfile",
  "tiny_http",
  "url",
- "urlencoding",
 ]
 
 [[package]]

adk-rust/crates/aw-contour-smoke/Cargo.toml

@@ -8,11 +8,6 @@ publish.workspace = true
 
 [dependencies]
 anyhow.workspace = true
-chrono.workspace = true
 clap.workspace = true
 reqwest.workspace = true
 serde_json.workspace = true
-url.workspace = true
-
-[dev-dependencies]
-tempfile.workspace = true

adk-rust/crates/aw-health-check/Cargo.toml

@@ -10,6 +10,3 @@ publish.workspace = true
 anyhow.workspace = true
 reqwest.workspace = true
 serde_json.workspace = true
-
-[dev-dependencies]
-tempfile.workspace = true

adk-rust/crates/check-aw-data/Cargo.toml

@@ -12,6 +12,3 @@ chrono.workspace = true
 clap.workspace = true
 reqwest.workspace = true
 serde_json.workspace = true
-
-[dev-dependencies]
-tempfile.workspace = true

adk-rust/crates/check-aw-full/Cargo.toml

@@ -12,6 +12,3 @@ chrono.workspace = true
 clap.workspace = true
 reqwest.workspace = true
 serde_json.workspace = true
-
-[dev-dependencies]
-tempfile.workspace = true

adk-rust/crates/detmir-status/Cargo.toml

@@ -19,5 +19,4 @@ adk-rust.workspace = true
 anyhow.workspace = true
 clap.workspace = true
 detmir-state.workspace = true
-serde.workspace = true
 serde_json.workspace = true

adk-rust/crates/diag-and-manual-restart/Cargo.toml

@@ -10,6 +10,3 @@ publish.workspace = true
 anyhow.workspace = true
 chrono.workspace = true
 clap.workspace = true
-
-[dev-dependencies]
-tempfile.workspace = true

adk-rust/crates/hayabusa-tools/Cargo.toml

@@ -31,7 +31,6 @@ regex.workspace = true
 reqwest.workspace = true
 serde.workspace = true
 serde_json.workspace = true
-urlencoding.workspace = true
 
 [dev-dependencies]
 tempfile.workspace = true

adk-rust/crates/rdp-worktime-report/Cargo.toml

@@ -13,6 +13,3 @@ clap.workspace = true
 reqwest.workspace = true
 serde.workspace = true
 serde_json.workspace = true
-
-[dev-dependencies]
-tempfile.workspace = true

adk-rust/crates/worktime-api/Cargo.toml

@@ -15,7 +15,6 @@ serde.workspace = true
 serde_json.workspace = true
 tiny_http.workspace = true
 url.workspace = true
-urlencoding.workspace = true
 regex.workspace = true
 
 [dev-dependencies]