Add cargo-machete workflow

[KooshaPari]

User description

Add cargo-machete CI workflow to detect unused Rust dependencies.

---

Note

Low Risk
Low risk: adds a new CI job only, with no runtime or production code changes; main impact is potential new CI failures due to dependency linting.

Overview
Introduces a new GitHub Actions workflow (.github/workflows/cargo-machete.yml) that runs cargo machete . on pushes, pull requests, a weekly schedule, and manual dispatch to flag unused Rust dependencies.

^{Reviewed by Cursor Bugbot for commit a87c272. Bugbot is set up for automated code reviews on this repo. Configure here.}

---

CodeAnt-AI Description

Check for unused Rust dependencies in CI

What Changed

• A new CI job now scans the Rust codebase for unused dependencies on pull requests, pushes, weekly runs, and manual runs
• If unused dependencies are found, the workflow fails so they can be removed before merging

Impact

✅ Fewer unused Rust dependencies
✅ Cleaner dependency lists
✅ Earlier detection of dependency drift

🔄 Retrigger CodeAnt AI Review

Details

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

[gemini-code-assist]

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

[codeant-ai]

CodeAnt AI is reviewing your PR.

---

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

[cursor]

Cursor Bugbot has reviewed your changes and found 4 potential issues.

^{Bugbot Autofix is ON, but it could not run because on-demand usage is turned off. To enable Bugbot Autofix, turn on on-demand usage and set a spend limit in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit a87c272. Configure here.}

[cursor]

Push trigger lacks branch filter causing duplicate runs

Medium Severity

The push trigger has no branch filter, so the workflow fires on every push to every branch. Combined with the unfiltered pull_request trigger, every PR push produces two duplicate runs. Every other workflow in this repo (cargo-deny.yml, rust-ci.yml, ci.yml, codespell.yml) scopes push to branches: [main]. This inconsistency wastes CI minutes on every single push.

 

^{Reviewed by Cursor Bugbot for commit a87c272. Configure here.}

[cursor]

Redundant unused-dependency check duplicates existing cargo-shear job

Medium Severity

This workflow adds cargo-machete to detect unused Rust dependencies, but the repository already runs cargo-shear (a tool with the same purpose) in .github/workflows/rust-ci.yml under the cargo_shear job. Running two competing tools for the same analysis is redundant and may produce conflicting or confusing CI signals.

 

^{Reviewed by Cursor Bugbot for commit a87c272. Configure here.}

[cursor]

Checkout action version inconsistent with rest of repo

Low Severity

This workflow uses actions/checkout@v4, while every other workflow in the repository uses actions/checkout@v6. This is inconsistent and means this workflow misses any bug fixes, performance improvements, or security patches included in v5 and v6.

 

^{Reviewed by Cursor Bugbot for commit a87c272. Configure here.}

[cursor]

Install action uses mutable tag instead of pinned hash

Medium Severity

This workflow references taiki-e/install-action@v2 using a mutable tag. Every other usage of this action in the repository pins it to a specific commit hash (@44c6d64aa62cd779e873306675c7a58e86d6d532). Using a mutable tag is a supply-chain risk — the tag can be moved to point at different code without notice, potentially allowing arbitrary code execution in CI.

 

^{Reviewed by Cursor Bugbot for commit a87c272. Configure here.}

[codeant-ai]

CodeAnt AI finished reviewing your PR.